beatdrop | 95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f

Analysis

max time kernel
140s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 12:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f.dll
Size

248KB
MD5

e031c9984f65a9060ec1e70fbb84746b
SHA1

b01950ed9b1929fee04a9c23ac49e3de89e37228
SHA256

95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f
SHA512

5dd1f004516b9fc0f0c36bca22dafaed9103191ebeea291e8d6f32f9b01b77fb18a0c4c5d04bd760a38651380a3680ede8b07f3d522f710b3df228ac8d934a2b
SSDEEP

6144:Gv77pPt5CRJRYHdhtxESU6FmixSG8aKUBYA/D1Q:GvX5C/qdhMZpG8a2A5Q

Score

10^/10

beatdrop loader persistence

Malware Config

Signatures

BEATDROP
BEATDROP is a loader which uses Atlassian's Trello service as C&C.
loader beatdrop

Detects BEATDROP loader 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4568-12-0x00000000660C0000-0x0000000066108000-memory.dmp	family_beatdrop

Blocklisted process makes network request 6 IoCs

Processes:

rundll32.exe

flow pid process

4 4568 rundll32.exe
6 4568 rundll32.exe
11 4568 rundll32.exe
13 4568 rundll32.exe
15 4568 rundll32.exe
41 4568 rundll32.exe

flow	pid	process
4	4568	rundll32.exe
6	4568	rundll32.exe
11	4568	rundll32.exe
13	4568	rundll32.exe
15	4568	rundll32.exe
41	4568	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

rundll32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\UserSettingsVersionSVC = "C:\\Windows\\System32\\rundll32.exe \"C:\\Users\\Admin\\AppData\\Local\\IconCacheService.dll\",IconCacheDBService"	rundll32.exe

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\95bbd494cecc25a422fa35912ec2365f3200d5a18ea4bfad5566432eb0834f9f.dll,#1
1⤵
- Blocklisted process makes network request
- Adds Run key to start application
PID:4568

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4568-0-0x00007FFCEBF30000-0x00007FFCEC125000-memory.dmp

Filesize
2.0MB

Download
memory/4568-12-0x00000000660C0000-0x0000000066108000-memory.dmp

Filesize
288KB

Download