Overview

overview

10

Static

static

3

svchost.bin.exe

windows7_x64

10

svchost.bin.exe

windows7_x64

10

svchost.bin.exe

windows7_x64

10

svchost.bin.exe

windows7_x64

10

svchost.bin.exe

windows11_x64

10

svchost.bin.exe

windows10_x64

9

svchost.bin.exe

windows10_x64

svchost.bin.exe

windows10_x64

10

svchost.bin.exe

windows10_x64

10

svchost.bin.exe

windows10_x64

10

Resubmissions

04-09-2021 07:37

210904-jf39zshben 10

04-09-2021 07:35

210904-jeq82aeab3 10

Analysis

  • max time kernel
    1755s
  • max time network
    1830s
  • platform
    windows10_x64
  • resource
    win10-fr
  • submitted
    04-09-2021 07:35

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    svchost.bin.exe

  • Size

    6.6MB

  • MD5

    2787bb2d1ab223f8ac2692f3a8fd85fc

  • SHA1

    dc34ee4e46ddea333cdc90e4aad7589cb8ee1ea0

  • SHA256

    952e3e059251cd41e3c67006c5aa4b75fe3e6b0f18d96554b2d60d4ccfb78cb4

  • SHA512

    d79bd7599ccb09fa72b939a506d04e28cb958e59c3987ab4d375e76337d5b1e33369d59397338aaeaf938c14ec9d93b20501d5224d151631c69c874d0657e9f3

Score
10/10
beapyminerpersistenceworm

Malware Config

Signatures

  • Beapy

    Beapy is a python worm with crypto mining capabilities.

    minerwormbeapy
  • Modifies system executable filetype association 2 TTPs 3 IoCs
    persistence
  • Registers COM server for autorun 1 TTPs
    persistence
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 34 IoCs
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Drops file in System32 directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 46 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious use of AdjustPrivilegeToken 48 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5052
    • C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe
      "C:\Users\Admin\AppData\Local\Temp\svchost.bin.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4120
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c wmic ntdomain get domainname
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:500
        • C:\Windows\SysWOW64\Wbem\WMIC.exe
          wmic ntdomain get domainname
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:584
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c net localgroup administrators
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1308
        • C:\Windows\SysWOW64\net.exe
          net localgroup administrators
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1480
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 localgroup administrators
            5⤵
              PID:1556
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c net group "domain admins" /domain
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1748
          • C:\Windows\SysWOW64\net.exe
            net group "domain admins" /domain
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1848
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 group "domain admins" /domain
              5⤵
                PID:1932
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            C:\Windows\SysNative\WindowsPowerShell\v1.0\powershell.exe -exec bypass "import-module C:\Users\Admin\AppData\Local\Temp\m2.ps1"
            3⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:2340
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2340 -s 1916
              4⤵
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:3860
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c ipconfig /all
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2176
            • C:\Windows\SysWOW64\ipconfig.exe
              ipconfig /all
              4⤵
              • Gathers network information
              PID:2116
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            3⤵
            • Gathers network information
            PID:896
          • C:\Windows\SysWOW64\netstat.exe
            netstat -na
            3⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:888
      • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
        "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe" /update
        1⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:692
        • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe
          C:\Users\Admin\AppData\Local\Microsoft\OneDrive\StandaloneUpdater\OneDriveSetup.exe /update /peruser /childprocess /extractFilesWithLessThreadCount /renameReplaceOneDriveExe /renameReplaceODSUExe /removeNonCurrentVersions
          2⤵
          • Modifies system executable filetype association
          • Adds Run key to start application
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:2760
          • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe
            "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.150.0725.0001\FileSyncConfig.exe"
            3⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies registry class
            PID:5072
      • \??\c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s seclogon
        1⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2568
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
        1⤵
          PID:4904
        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
          1⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:3868
        • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
          "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
          1⤵
          • Drops file in System32 directory
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:3860

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/2340-194-0x000001253FF30000-0x000001253FF32000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2340-190-0x000001253FF40000-0x000001253FF41000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2340-189-0x0000012526150000-0x0000012526151000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2340-204-0x000001253FF36000-0x000001253FF38000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2340-188-0x000001253FFD0000-0x000001253FFD1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2340-196-0x0000012540400000-0x0000012540401000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2340-191-0x0000012540270000-0x0000012540271000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2340-195-0x000001253FF33000-0x000001253FF35000-memory.dmp

          Filesize

          8KB

          Download

        • memory/4120-132-0x0000000002B50000-0x0000000002C05000-memory.dmp

          Filesize

          724KB

          Download

        • memory/4120-128-0x0000000000D41000-0x0000000000D46000-memory.dmp

          Filesize

          20KB

          Download

        • memory/4120-174-0x0000000002C40000-0x0000000002C55000-memory.dmp

          Filesize

          84KB

          Download

        • memory/4120-170-0x0000000002C30000-0x0000000002C40000-memory.dmp

          Filesize

          64KB

          Download

        • memory/4120-145-0x0000000000D50000-0x0000000000DCC000-memory.dmp

          Filesize

          496KB

          Download

        • memory/4120-156-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

          Filesize

          64KB

          Download