Multi-Layered Infection Attack Installs Betabot Malware

The Betabot Trojan is being spread in a multi-stage attack that starts with malicious Office documents attempting to exploit a 17-year old vulnerability. Betabot is a piece of malware that evolved from being a banking Trojan to a password stealer, and then a botnet capable of distributing ransomware and other malicious programs. Although readily available for purchase on underground markets at around $120, a cracked version of the malware was also observed in early 2017.  The recently spotted attacks start with a Word document attempting to exploit CVE-2017–11882, a vulnerability introduced in November 2000 in the Microsoft Equation Editor (EQNEDT32.EXE) component. Discovered only last year, the security bug was manually patched by Microsoft in late 2017.  As part of this attack, the actor embedded an OLE object into a specially crafted RTF file to execute commands on the victim system. The embedded objects (inteldriverupd1.sct, task.bat, decoy.doc, exe.exe, and 2nd.bat) pose as legitimate software to gain the intended victim’s trust. The inteldriverupd1.sct file leverages Windows Script Component and creates a new object, which next runs the task.bat script to check for a block.txt file in the temp directory, create the file if it doesn’t exist, and start 2nd.bat before deleting itself.