beatdrop | 5f01eb447cb63c40c2d923b15c5ecb5ba47ea72e600797d5d96e228f4cf13f13

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 11:22

Target

5f01eb447cb63c40c2d923b15c5ecb5ba47ea72e600797d5d96e228f4cf13f13.dll
Size

247KB
MD5

c4df0507f56e30b264c848c6096b69ae
SHA1

09841dc9c6f1d2e38d104da514901fbcd028a8f9
SHA256

5f01eb447cb63c40c2d923b15c5ecb5ba47ea72e600797d5d96e228f4cf13f13
SHA512

56a9778bdc8a8c86a3947594502ec46136cf4ed9c7bdc71c15630659b4c310bc42a89a995a192fbde0b29f3c8cd0c31a2fd50e10cffde11b5a74fb8eadd8df92
SSDEEP

6144:Kw7pPIEmwwD8xijj1WSo0+doNzpCUBlHI:kEmfAM1+doXHI

Score

10^/10

beatdrop loader

BEATDROP
BEATDROP is a loader which uses Atlassian's Trello service as C&C.
loader beatdrop

Detects BEATDROP loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3860-12-0x00000000660C0000-0x0000000066107000-memory.dmp	family_beatdrop

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

3 3860 rundll32.exe
6 3860 rundll32.exe
8 3860 rundll32.exe
13 3860 rundll32.exe
15 3860 rundll32.exe
49 3860 rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\5f01eb447cb63c40c2d923b15c5ecb5ba47ea72e600797d5d96e228f4cf13f13.dll,#1
1⤵
- Blocklisted process makes network request
PID:3860

memory/3860-0-0x00007FFC7A2B0000-0x00007FFC7A4A5000-memory.dmp

Filesize
2.0MB

Download
memory/3860-12-0x00000000660C0000-0x0000000066107000-memory.dmp

Filesize
284KB

Download