1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c

General

Target

1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
Size

260KB
MD5

03adf1bb9cdf0d837f18c1dc12db0c52
SHA1

b61134f4402b622163b226e9559518d770747762
SHA256

1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c
SHA512

ff224b92542289c8182c2d4fdf65e81d449dd0be67245e331746d8c2c0dbc365480baf09212888b81b9168b197e49c2f03474a72e5be8b35150da71b2714be89
SSDEEP

3072:gsgZWWTiooHiUS41IGymUU5fkUehyB456J2Lw6BoiEx4PvsL2o5n33ygoe:rOToHiUBiGyuT236J2deiEx4PvRo53Fv

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

Processes:

1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exebeyuh.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	beyuh.exe

Executes dropped EXE 1 IoCs

Processes:

beyuh.exe

pid process

3316 beyuh.exe

pid	process
3316	beyuh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe

Adds Run key to start application 2 TTPs 53 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

beyuh.exe1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /R"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /E"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /v"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /O"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /a"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /y"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /H"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /l"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /P"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /e"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /t"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /c"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /U"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /X"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /g"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /u"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /b"	beyuh.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /k"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /j"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /d"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /J"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /M"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /m"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /q"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /Z"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /C"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /r"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /n"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /Q"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /Y"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /s"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /z"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /f"	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /A"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /i"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /I"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /x"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /K"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /W"	beyuh.exe
Key created	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run\	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /T"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /V"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /o"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /F"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /h"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /w"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /p"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /D"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /L"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /G"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /B"	beyuh.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beyuh = "C:\\Users\\Admin\\beyuh.exe /S"	beyuh.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exebeyuh.exe

pid	process
2624	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
2624	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe
3316	beyuh.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exebeyuh.exe

pid process

2624 1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
3316 beyuh.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe

description	pid	process	target process
PID 2624 wrote to memory of 3316	2624	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe	beyuh.exe
PID 2624 wrote to memory of 3316	2624	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe	beyuh.exe
PID 2624 wrote to memory of 3316	2624	1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe	beyuh.exe

C:\Users\Admin\AppData\Local\Temp\1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe
"C:\Users\Admin\AppData\Local\Temp\1da70ebedfd09c950b6ba8a5634fedd32a934df397d5c55679b0164e0f7aa99c.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\beyuh.exe
"C:\Users\Admin\beyuh.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3316

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Hidden Files and Directories

1

T1158

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Hidden Files and Directories

1

T1158

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\beyuh.exe
Filesize
260KB

MD5
e966f5f229c70f002fc26125eafb3e07

SHA1
2cd9f82089e8b75d354980eae680b5c65f4c7340

SHA256
d661dac8be8281a1440ba354c56117ef89f6e3f7d4133c24686c7470780d5980

SHA512
abc2ddc39e762bc81a2b1fe36261ab69010e19b413bc3e97bbc5ec0016c74c3534dbdeac4bb25ebc4d82dccba7f9b65d6cd0b90eefc632e02afe95b2b10d31bc

Download Submit
C:\Users\Admin\beyuh.exe
Filesize
260KB

MD5
e966f5f229c70f002fc26125eafb3e07

SHA1
2cd9f82089e8b75d354980eae680b5c65f4c7340

SHA256
d661dac8be8281a1440ba354c56117ef89f6e3f7d4133c24686c7470780d5980

SHA512
abc2ddc39e762bc81a2b1fe36261ab69010e19b413bc3e97bbc5ec0016c74c3534dbdeac4bb25ebc4d82dccba7f9b65d6cd0b90eefc632e02afe95b2b10d31bc

Download Submit
memory/2624-134-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/2624-135-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3316-136-0x0000000000000000-mapping.dmp

Download
memory/3316-141-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download
memory/3316-142-0x0000000000400000-0x0000000000442000-memory.dmp

Filesize
264KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads