Overview
overview
9Static
static
3Beat Bange...es.url
windows10-1703-x64
1Beat Bange...es.url
windows10-1703-x64
1Beat Bange...up.exe
windows10-1703-x64
7Beat Bange...up.exe
windows10-1703-x64
7Beat Bange...ll.bat
windows10-1703-x64
7Beat Bange...st.exe
windows10-1703-x64
6Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
9Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
4Beat Bange...86.exe
windows10-1703-x64
4Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...64.exe
windows10-1703-x64
7Beat Bange...86.exe
windows10-1703-x64
7Beat Bange...st.msi
windows10-1703-x64
6Beat Bange...le.exe
windows10-1703-x64
1Beat Bange...er.exe
windows10-1703-x64
1Beat Bange...eg.exe
windows10-1703-x64
1Beat Bange...be.exe
windows10-1703-x64
1Analysis
-
max time kernel
17s -
max time network
197s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
02-09-2024 19:23
Static task
static1
Behavioral task
behavioral1
Sample
Beat Banger - SteamGG.NET/SteamGG – Free Download Pre-installed Steam Games.url
Resource
win10-20240404-en
Behavioral task
behavioral2
Sample
Beat Banger - SteamGG.NET/_Redist/SteamGG – Free Download Pre-installed Steam Games.url
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
Beat Banger - SteamGG.NET/_Redist/dotNetFx40_Full_setup.exe
Resource
win10-20240404-en
Behavioral task
behavioral4
Sample
Beat Banger - SteamGG.NET/_Redist/dxwebsetup.exe
Resource
win10-20240404-en
Behavioral task
behavioral5
Sample
Beat Banger - SteamGG.NET/_Redist/install_all.bat
Resource
win10-20240404-en
Behavioral task
behavioral6
Sample
Beat Banger - SteamGG.NET/_Redist/oalinst.exe
Resource
win10-20240404-en
Behavioral task
behavioral7
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2005_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral8
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2005_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral9
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2008_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral10
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2008_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral11
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2010_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral12
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2010_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral13
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2012_x64.exe
Resource
win10-20240611-en
Behavioral task
behavioral14
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2012_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral15
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2013_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral16
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2013_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral17
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2015_2017_2019_2022_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral18
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist2015_2017_2019_2022_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral19
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_2015-2019_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral20
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_2015-2019_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral21
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_x64.exe
Resource
win10-20240404-en
Behavioral task
behavioral22
Sample
Beat Banger - SteamGG.NET/_Redist/vcredist_x86.exe
Resource
win10-20240404-en
Behavioral task
behavioral23
Sample
Beat Banger - SteamGG.NET/_Redist/xnafx40_redist.msi
Resource
win10-20240404-en
Behavioral task
behavioral24
Sample
Beat Banger - SteamGG.NET/beatbanger.console.exe
Resource
win10-20240611-en
Behavioral task
behavioral25
Sample
Beat Banger - SteamGG.NET/beatbanger.exe
Resource
win10-20240404-en
Behavioral task
behavioral26
Sample
Beat Banger - SteamGG.NET/bin/win64/ffmpeg.exe
Resource
win10-20240404-en
Behavioral task
behavioral27
Sample
Beat Banger - SteamGG.NET/bin/win64/ffprobe.exe
Resource
win10-20240611-en
General
-
Target
Beat Banger - SteamGG.NET/beatbanger.console.exe
-
Size
65KB
-
MD5
1ec06c874151c224d7289daefc916088
-
SHA1
e7f4581935cdfdad635bf96ef8cbdc00ca5c961d
-
SHA256
424cc5d0fa1ed54c8ba5bd86ed9506102778fe212567de09461c7036c5826e9d
-
SHA512
c215c4012478f42c26755756b8b2f3de3ea4b5d27750bcbdbca85c48da96a5fcf37dab1902f4251825a78d169ce9fe302ac6b12c0cd1b0e618f2cbd231df50c4
-
SSDEEP
1536:/vkeFQfCPO8mBGsyAWhoDW2IfKYhVYbZDV7+B7T:/ceF0tGRhoDW2SKYhVYVZu7
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 1852 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1852 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
beatbanger.exepid process 3576 beatbanger.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
beatbanger.exepid process 3576 beatbanger.exe 3576 beatbanger.exe 3576 beatbanger.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
beatbanger.console.exedescription pid process target process PID 1844 wrote to memory of 3576 1844 beatbanger.console.exe beatbanger.exe PID 1844 wrote to memory of 3576 1844 beatbanger.console.exe beatbanger.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Beat Banger - SteamGG.NET\beatbanger.console.exe"C:\Users\Admin\AppData\Local\Temp\Beat Banger - SteamGG.NET\beatbanger.console.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Users\Admin\AppData\Local\Temp\Beat Banger - SteamGG.NET\beatbanger.exe"C:\Users\Admin\AppData\Local\Temp\Beat Banger - SteamGG.NET\beatbanger.exe"2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3576
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4141⤵
- Suspicious use of AdjustPrivilegeToken
PID:1852
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256B
MD50b9328ee5fe8aca8b671a526c0320a34
SHA1d15ca3909180b246054676799933ef23085f4264
SHA256699f4315b5048c6721e90fee12a6a178aa2c3bf3521eac5cd713b548d3fe4b14
SHA512e5460909810ee87146d157dcd527a038c23380f4dc989d9c3236e0503842e7f855f09f0b95244c913b82bd67bfc1f956196cdb443a39627121927b885dbaa83e