svchost.bin.zip

General
Target

svchost.bin.zip

Size

6MB

Sample

210904-jeq82aeab3

Score
10 /10
MD5

5224c529a6e9ebe343ab37ad8ba99d86

SHA1

056935a88a4877b30ad74ddf2e2c838d0d5b1faf

SHA256

591bf6c785a42e2ad6c91e94c544e69e68a0484acd47c1b1747b49d8fb1b3d11

SHA512

4b5c2d5d8e5a0b65490c0999e4bca11836d5e75992906fa929b3ff3131b546449ddef5de697a124b0bc4b8a83e1a682db2d487e25193acda7af47f76115bf3f6

Malware Config
Targets
Target

svchost.bin

MD5

2787bb2d1ab223f8ac2692f3a8fd85fc

Filesize

6MB

Score
10 /10
SHA1

dc34ee4e46ddea333cdc90e4aad7589cb8ee1ea0

SHA256

952e3e059251cd41e3c67006c5aa4b75fe3e6b0f18d96554b2d60d4ccfb78cb4

SHA512

d79bd7599ccb09fa72b939a506d04e28cb958e59c3987ab4d375e76337d5b1e33369d59397338aaeaf938c14ec9d93b20501d5224d151631c69c874d0657e9f3

Tags

Signatures

  • Beapy

    Description

    Beapy is a python worm with crypto mining capabilities.

    Tags

  • Modifies system executable filetype association

    Tags

    TTPs

    Modify Registry Change Default File Association
  • Registers COM server for autorun

    Tags

    TTPs

    Registry Run Keys / Startup Folder
  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Grants admin privileges

    Description

    Uses net.exe to modify the user's privileges.

    TTPs

    Account Manipulation
  • Blocklisted process makes network request

  • Executes dropped EXE

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup Folder Modify Registry
  • Drops file in System32 directory

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Privilege Escalation
                  Tasks

                  static1

                  3/10

                  behavioral1

                  10/10

                  behavioral5

                  10/10

                  behavioral6

                  9/10

                  behavioral7

                  1/10

                  behavioral8

                  10/10

                  behavioral9

                  10/10

                  behavioral10

                  10/10