Overview
overview
10Static
static
3BetaUnfrated.exe
windows7-x64
10BetaUnfrated.exe
windows10-2004-x64
10$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3BetaUnfated.exe
windows7-x64
10BetaUnfated.exe
windows10-2004-x64
10LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/...dex.js
windows7-x64
1resources/...dex.js
windows10-2004-x64
1resources/....2.bat
windows7-x64
7resources/....2.bat
windows10-2004-x64
7resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1swiftshade...GL.dll
windows7-x64
1swiftshade...GL.dll
windows10-2004-x64
1swiftshade...v2.dll
windows7-x64
1swiftshade...v2.dll
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1vk_swiftshader.dll
windows10-2004-x64
1vulkan-1.dll
windows7-x64
1vulkan-1.dll
windows10-2004-x64
1$PLUGINSDI...7z.dll
windows7-x64
3Analysis
- max time kernel
156s - max time network
179s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
17/04/2024, 11:58
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
BetaUnfrated.exe
Resource
win7-20240221-en
windows7-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
BetaUnfrated.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
2 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral7
Sample
BetaUnfated.exe
Resource
win7-20240221-en
windows7-x64
19 signatures
150 seconds
Behavioral task
behavioral8
Sample
BetaUnfated.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral9
Sample
LICENSES.chromium.html
Resource
win7-20240215-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral10
Sample
LICENSES.chromium.html
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20240319-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral18
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/index.js
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win7-20231129-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral21
Sample
resources/app.asar.unpacked/node_modules/screenshot-desktop/lib/win32/screenCapture_1.3.2.bat
Resource
win10v2004-20240226-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral22
Sample
resources/elevate.exe
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
resources/elevate.exe
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral24
Sample
swiftshader/libEGL.dll
Resource
win7-20240220-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral25
Sample
swiftshader/libEGL.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral26
Sample
swiftshader/libGLESv2.dll
Resource
win7-20240221-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral27
Sample
swiftshader/libGLESv2.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral28
Sample
vk_swiftshader.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
vk_swiftshader.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral30
Sample
vulkan-1.dll
Resource
win7-20240221-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral31
Sample
vulkan-1.dll
Resource
win10v2004-20240412-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral32
Sample
$PLUGINSDIR/nsis7z.dll
Resource
win7-20240221-en
windows7-x64
2 signatures
150 seconds
General
- Target BetaUnfated.exe
- Size 139.8MB
- Sample240417-n47drsfe41
- SHA256 705dc4d21549b6603587ef120e0849814871bdd5fcd10c5fb6235e0ff779b6df
- MD5 8a648d6aa159c835df037c21917b28bf
- SHA1 80678dfdf60594f022fb00cb0123b109c36a1f94
- SHA512 76a44f60afd1f0383ccb7f997fec5f38db6953b83fcc3ea26fcad982ebaf52984bd080fa16dc1b3c229e082b20fd61e075eb09da054a5b13f85ecdd20a2fa99c
- SSDEEP 786432:sSfg0tbLs2cRE3FsdxwBFyAaZZiljQWohhjbj6S46P845IPD:sSj5szmFcxwBFyAaZ4jMhhXcyC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Enumerates VirtualBox registry keys 2 TTPs 5 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest BetaUnfated.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse BetaUnfated.exe - Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ BetaUnfated.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__ BetaUnfated.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__ BetaUnfated.exe - Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions BetaUnfated.exe - Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools BetaUnfated.exe - Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate BetaUnfated.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion BetaUnfated.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion BetaUnfated.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation BetaUnfated.exe Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation BetaUnfated.exe - Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Wine BetaUnfated.exe - Loads dropped DLL 3 IoCs
pid Process 3216 BetaUnfated.exe 3216 BetaUnfated.exe 3216 BetaUnfated.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\Windows\\0\\WindowsUpdater.exe" reg.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ipinfo.io 12 ipinfo.io - Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
description ioc Process File opened (read-only) \??\VBoxMiniRdrDN BetaUnfated.exe - Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1772 WMIC.exe - Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 684 tasklist.exe 4720 tasklist.exe - Kills process with taskkill 2 IoCs
pid Process 820 taskkill.exe 1396 taskkill.exe - Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 3216 BetaUnfated.exe 3216 BetaUnfated.exe 4176 BetaUnfated.exe 4176 BetaUnfated.exe 5084 BetaUnfated.exe 5084 BetaUnfated.exe 4784 BetaUnfated.exe 4784 BetaUnfated.exe 4784 BetaUnfated.exe 4784 BetaUnfated.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3216 BetaUnfated.exe Token: SeCreatePagefilePrivilege 3216 BetaUnfated.exe Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: 36 2672 WMIC.exe Token: SeIncreaseQuotaPrivilege 2672 WMIC.exe Token: SeSecurityPrivilege 2672 WMIC.exe Token: SeTakeOwnershipPrivilege 2672 WMIC.exe Token: SeLoadDriverPrivilege 2672 WMIC.exe Token: SeSystemProfilePrivilege 2672 WMIC.exe Token: SeSystemtimePrivilege 2672 WMIC.exe Token: SeProfSingleProcessPrivilege 2672 WMIC.exe Token: SeIncBasePriorityPrivilege 2672 WMIC.exe Token: SeCreatePagefilePrivilege 2672 WMIC.exe Token: SeBackupPrivilege 2672 WMIC.exe Token: SeRestorePrivilege 2672 WMIC.exe Token: SeShutdownPrivilege 2672 WMIC.exe Token: SeDebugPrivilege 2672 WMIC.exe Token: SeSystemEnvironmentPrivilege 2672 WMIC.exe Token: SeRemoteShutdownPrivilege 2672 WMIC.exe Token: SeUndockPrivilege 2672 WMIC.exe Token: SeManageVolumePrivilege 2672 WMIC.exe Token: 33 2672 WMIC.exe Token: 34 2672 WMIC.exe Token: 35 2672 WMIC.exe Token: 36 2672 WMIC.exe Token: SeShutdownPrivilege 3216 BetaUnfated.exe Token: SeCreatePagefilePrivilege 3216 BetaUnfated.exe Token: SeShutdownPrivilege 3216 BetaUnfated.exe Token: SeCreatePagefilePrivilege 3216 BetaUnfated.exe Token: SeDebugPrivilege 820 taskkill.exe Token: SeShutdownPrivilege 3216 BetaUnfated.exe Token: SeCreatePagefilePrivilege 3216 BetaUnfated.exe Token: SeDebugPrivilege 1396 taskkill.exe Token: SeDebugPrivilege 684 tasklist.exe Token: SeShutdownPrivilege 3216 BetaUnfated.exe Token: SeCreatePagefilePrivilege 3216 BetaUnfated.exe Token: SeShutdownPrivilege 3216 BetaUnfated.exe Token: SeCreatePagefilePrivilege 3216 BetaUnfated.exe Token: SeIncreaseQuotaPrivilege 1608 WMIC.exe Token: SeSecurityPrivilege 1608 WMIC.exe Token: SeTakeOwnershipPrivilege 1608 WMIC.exe Token: SeLoadDriverPrivilege 1608 WMIC.exe Token: SeSystemProfilePrivilege 1608 WMIC.exe Token: SeSystemtimePrivilege 1608 WMIC.exe Token: SeProfSingleProcessPrivilege 1608 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3216 BetaUnfated.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3216 wrote to memory of 3852 3216 BetaUnfated.exe 92 PID 3216 wrote to memory of 3852 3216 BetaUnfated.exe 92 PID 3852 wrote to memory of 2672 3852 cmd.exe 94 PID 3852 wrote to memory of 2672 3852 cmd.exe 94 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 2320 3216 BetaUnfated.exe 95 PID 3216 wrote to memory of 4176 3216 BetaUnfated.exe 96 PID 3216 wrote to memory of 4176 3216 BetaUnfated.exe 96 PID 3216 wrote to memory of 5084 3216 BetaUnfated.exe 97 PID 3216 wrote to memory of 5084 3216 BetaUnfated.exe 97 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100 PID 3216 wrote to memory of 2900 3216 BetaUnfated.exe 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"1⤵
- Enumerates VirtualBox registry keys
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Checks computer location settings
- Identifies Wine through registry keys
- Loads dropped DLL
- Checks for VirtualBox DLLs, possible anti-VM trick
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic CsProduct Get UUID"2⤵
- Suspicious use of WriteProcessMemory
PID:3852 -
C:\Windows\System32\Wbem\WMIC.exewmic CsProduct Get UUID3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2672
-
-
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaUnfated" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1780,1270283302249063414,8468849067640326185,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2320
-
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaUnfated" --mojo-platform-channel-handle=2052 --field-trial-handle=1780,1270283302249063414,8468849067640326185,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4176
-
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaUnfated" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --no-sandbox --no-zygote --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --mojo-platform-channel-handle=2384 --field-trial-handle=1780,1270283302249063414,8468849067640326185,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:12⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
PID:5084
-
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaUnfated" --mojo-platform-channel-handle=2748 --field-trial-handle=1780,1270283302249063414,8468849067640326185,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵PID:2900
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM chrome.exe /F"2⤵PID:4752
-
C:\Windows\system32\taskkill.exetaskkill /IM chrome.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:820
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "taskkill /IM msedge.exe /F"2⤵PID:4184
-
C:\Windows\system32\taskkill.exetaskkill /IM msedge.exe /F3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1396
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions""2⤵PID:3132
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions"3⤵PID:5044
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath"2⤵PID:1976
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe QUERY "HKCU\Software\Valve\Steam" /v SteamPath3⤵PID:3112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:728
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:684
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List"2⤵PID:1712
-
C:\Windows\System32\Wbem\WMIC.exewmic /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntiVirusProduct Get displayName /Format:List3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "wmic path win32_VideoController get name"2⤵PID:2672
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_VideoController get name3⤵
- Detects videocard installed
PID:1772
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "cmd /c chcp 65001>nul && netsh wlan show profiles"2⤵PID:4008
-
C:\Windows\system32\cmd.execmd /c chcp 650013⤵PID:3232
-
C:\Windows\system32\chcp.comchcp 650014⤵PID:4048
-
-
-
C:\Windows\system32\netsh.exenetsh wlan show profiles3⤵PID:4752
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "C:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f"2⤵PID:3248
-
C:\Windows\system32\reg.exeC:\Windows\system32\reg.exe ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v WindowsUpdater /t REG_SZ /d C:\Users\Admin\AppData\Local\Microsoft\Windows\0\WindowsUpdater.exe /f3⤵
- Adds Run key to start application
PID:3504
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:2964
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:4720
-
-
-
C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe"C:\Users\Admin\AppData\Local\Temp\BetaUnfated.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\BetaUnfated" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAIAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3704 --field-trial-handle=1780,1270283302249063414,8468849067640326185,131072 --disable-features=PlzServiceWorker,SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4784
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4924
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x50c 0x3881⤵PID:1748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\13f50260-e373-4a79-92d7-9b906f3e869f.tmp.node
- Size 163KB
- SHA256 8d6f5cab1d6a99ac49772080c6f383f33a9bb983e0f8d02d0f3de4b2bdd26215
- MD5 b0e113443ddc1ee234acbf0eb0e6f8a0
- SHA1 84cc562b82570ec05df6dbbfc8f29fbb16ec68c7
- SHA512 306e89ec66fdf8b0de19d5bcda01f69809d83f464a9c21fda4b470e81ad3b722aa6cb6086fb4c2af59504fe4332c1f9efff27168598cc00be0f28fed45dde8ee
- SSDEEP 3072:ka6VYNZlMDfTXQvj9PRl8OcQTpxNM0v1xYkNedgdv3I0l+MS7:kTVYMDfTgvj9PEjkvMt
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\97405982-49d6-471a-b93b-fce407f5a321.tmp.node
- Size 652KB
- SHA256 b314ee85e8f31cb13b5ed4d602615814cf1615646dc76b8eec7dc27551d8ba33
- MD5 aeeb49ada6f1fb805239308e4c6adb55
- SHA1 9f309664c10b4e181e0637cbb1f9b954bbf8ca00
- SHA512 e49bbeb8ec7a003667db17bc129a806053e7b1b139ad5d5c86472ca8f9c20a31fb90aae79313cc17685473b909381b5931d7e34a1228d5e624b1c742dccfc843
- SSDEEP 6144:lZNXP5VGi4aC1+YGPa74q2fZZP/i/roNn23h18pOodXbgP94T:lZNXPHTC1+jPar2fDPa/ychQOoBgla
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\c832a938-b83d-4190-9438-89663300717d.tmp.node
- Size 2.7MB
- SHA256 7c999c84852b1f46a48f75b130fea445280d7032a56359dffecf36730366abc5
- MD5 08b28072c6d59fdf06a808182efed01f
- SHA1 35253af00af3308a64cff1eda104fd7227abb2f4
- SHA512 f2592ade5053b674dbe4191c7001748a801dca3b19e97e19b440a3e944011c87926b0ef21c87e98b48e038889a32e01c1d74949124be3144834e2f06d9781198
- SSDEEP 49152:IcbZZ3iGVhn8mIiiTINlF/sif0KPRrMg7HPM6A8:z9YqM6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\AutoFill Data\All Autofill Data.txt
- Size 240B
- SHA256 453478914b72d9056472fb1e44c69606c62331452f47a1f3c02190f26501785c
- MD5 810ae82f863a5ffae14d3b3944252a4e
- SHA1 5393e27113753191436b14f0cafa8acabcfe6b2a
- SHA512 2421a397dd2ebb17947167addacd3117f666ddab388e3678168075f58dc8eee15bb49a4aac2290140ae5102924852d27b538740a859d0b35245f505b20f29112
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\epsilon-Admin\Credit Cards\All Credit Cards.txt
- Size 231B
- SHA256 753b99d2b4e8c58bfd10995d0c2c19255fe9c8f53703bb27d1b6f76f1f4e83cc
- MD5 dec2be4f1ec3592cea668aa279e7cc9b
- SHA1 327cf8ab0c895e10674e00ea7f437784bb11d718
- SHA512 81728e3d31b72905b3a09c79d1e307c4e8e79d436fcfe7560a8046b46ca4ae994fdfaeb1bc2328e35f418b8128f2e7239289e84350e142146df9cde86b20bb66
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\BetaUnfated\Network\Network Persistent State
- Size 393B
- SHA256 aca6372ab7edfd0f10f073212c312d3d17965d2d4edc0a999bed493c08912b4f
- MD5 5aa7d1f4c9b756beb3eef67f07d9bf23
- SHA1 e1c036eef1d26e78cd4e3b4058d4e3d094bdd8ef
- SHA512 215957a2a4a089095aff51ff82e373755a1748c296c9944f6e2a7577703418cd3aa9cb9856c864cfb0aed3e99a18d67fc49ab8d5ef328f72a5f854a1eb362121
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\BetaUnfated\Network\Network Persistent State~RFe599a42.TMP
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
- Size 2B
- SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
- MD5 f3b25701fe362ec84616a93a45ce9998
- SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
- SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
- MD5 SHA1 SHA512