beapy

Resubmissions

04-09-2021 07:37

210904-jf39zshben 10

04-09-2021 07:35

210904-jeq82aeab3 10

Sharing

Copy URL

Twitter E-mail

General

Target

svchost.bin.zip
Size

6.5MB
Sample

210904-jeq82aeab3
MD5

5224c529a6e9ebe343ab37ad8ba99d86
SHA1

056935a88a4877b30ad74ddf2e2c838d0d5b1faf
SHA256

591bf6c785a42e2ad6c91e94c544e69e68a0484acd47c1b1747b49d8fb1b3d11
SHA512

4b5c2d5d8e5a0b65490c0999e4bca11836d5e75992906fa929b3ff3131b546449ddef5de697a124b0bc4b8a83e1a682db2d487e25193acda7af47f76115bf3f6

Score

10^/10

Malware Config

Targets

- Target
  
  svchost.bin
- Size
  
  6.6MB
- MD5
  
  2787bb2d1ab223f8ac2692f3a8fd85fc
- SHA1
  
  dc34ee4e46ddea333cdc90e4aad7589cb8ee1ea0
- SHA256
  
  952e3e059251cd41e3c67006c5aa4b75fe3e6b0f18d96554b2d60d4ccfb78cb4
- SHA512
  
  d79bd7599ccb09fa72b939a506d04e28cb958e59c3987ab4d375e76337d5b1e33369d59397338aaeaf938c14ec9d93b20501d5224d151631c69c874d0657e9f3
Score

10^/10

beapy evasion miner worm pyinstaller persistence
- Beapy
  Beapy is a python worm with crypto mining capabilities.
  miner worm beapy
- Modifies system executable filetype association
  persistence
- Registers COM server for autorun
  persistence
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Grants admin privileges
  Uses net.exe to modify the user's privileges.
- Blocklisted process makes network request
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops file in System32 directory
behavioral1 behavioral2 behavioral3 behavioral4 behavioral5 behavioral6 behavioral7 behavioral8 behavioral9 behavioral10

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Command-Line Interface

T1059

Persistence

Change Default File Association

T1042

Registry Run Keys / Startup Folder

T1060

Account Manipulation

T1098

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Targets

Modifies system executable filetype association

Registers COM server for autorun

Suspicious use of NtCreateUserProcessOtherParentProcess

Grants admin privileges

Blocklisted process makes network request

Executes dropped EXE

Modifies Windows Firewall

Loads dropped DLL

Adds Run key to start application

Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10