533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908

General

Target

533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe
Size

89KB
MD5

0695355b3e2836b54ad99e0ca1a5e870
SHA1

af68748b5048032dd5c53c79d5975bc90009668a
SHA256

533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908
SHA512

e26cd900fc56aaf677eff2b1fe4ec3ebc82c2fd93df4cb0b70ce33154fcf4350911b0abe5dc910d921402ff60888bc0af099ec9798050af55fe1fdbd287b9388
SSDEEP

768:UMEKb6K4Fd6eUCRGIIPP1y7oLacaIBLP3ner42Q:UXTFTUCxQ1aZr42Q

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies visiblity of hidden/system files in Explorer 2 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Processes:

533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exebeiaqiq.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	beiaqiq.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe

Executes dropped EXE 1 IoCs

Processes:

beiaqiq.exe

pid process

4920 beiaqiq.exe

pid	process
4920	beiaqiq.exe

Adds Run key to start application 2 TTPs 27 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

beiaqiq.exe533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /f"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /t"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /u"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /b"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /r"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /i"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /h"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /o"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /d"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /x"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /m"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /e"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /n"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /s"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /p"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /i"	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /w"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /q"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /v"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /z"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /j"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /k"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /a"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /g"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /y"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /l"	beiaqiq.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\beiaqiq = "C:\\Users\\Admin\\beiaqiq.exe /c"	beiaqiq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exebeiaqiq.exe

pid	process
4112	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe
4112	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe
4920	beiaqiq.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exebeiaqiq.exe

pid process

4112 533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe
4920 beiaqiq.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe

description	pid	process	target process
PID 4112 wrote to memory of 4920	4112	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe	beiaqiq.exe
PID 4112 wrote to memory of 4920	4112	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe	beiaqiq.exe
PID 4112 wrote to memory of 4920	4112	533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe	beiaqiq.exe

C:\Users\Admin\AppData\Local\Temp\533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe
"C:\Users\Admin\AppData\Local\Temp\533b609b47ce77193077d80b94b5d523844f6b6dca6ea00bf64d2d0f4b857908.exe"
1⤵
- Modifies visiblity of hidden/system files in Explorer
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4112

C:\Users\Admin\beiaqiq.exe
"C:\Users\Admin\beiaqiq.exe"
2⤵
- Modifies visiblity of hidden/system files in Explorer
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4920

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Hide Artifacts

1

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\beiaqiq.exe
Filesize
89KB

MD5
623a6d853b127af0ba58302ee6e98416

SHA1
c3f88db09062ee3c4aa9a7fa62e9fee8133f8dff

SHA256
ca527700cf953ab09e9fac4db0623ffa2a13daa19e01d25e402b25581ac71472

SHA512
8f94a60a797b5f1ff391b6bb48189c51b489359b8d4d2550cba19674e9b828e0f91ae6deebfa52b6506dd8a8dbba300a6cbabc495b4e8ea8526db61cbb4a212e

Download Submit
memory/4112-0-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/4920-22-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads