Analysis
- user interaction
yes - max time kernel
82s - max time network
81s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
24/04/2026, 00:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
StealthBeacon.exe
Resource
win11-20260130-en
windows11-21h2-x64
7 signatures
150 seconds
General
- Target StealthBeacon.exe
- Size 137KB
- Sample260424-aecafaaz9z
- SHA256 18369e7a4aabcf90b3a660f60de7d6df16d028ee906691729ef1408995deb260
- MD5 556f79eac2bfb4b160adf4471e9acedf
- SHA1 8716aa71dd9b606fde25f65af9fbbb2cc98ad509
- SHA512 1ae35ee66b5b6627383406813a0dc73286cf6cdc316e1d9bc3359e17c64955d14a7452cea3b2c742a416c762159dfaea89d318a2ed51f5cf1905d62babf8e0a8
- SSDEEP 3072:qgpDjTjBFJm/y7IBW6W0A0bT66s6KCjX:qcrk/KeWR0qSjX
- TLSH T132D35B17FAA630FED17B8975C4520905EB72BC7257A1ABDF07900EE60E526D08E3EB11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2397528088-2630719772-1129911217-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.WindowsTerminal_8wekyb3d8bbwe\StartTerminalOnLoginTask taskmgr.exe - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 5176 taskmgr.exe Token: SeSystemProfilePrivilege 5176 taskmgr.exe Token: SeCreateGlobalPrivilege 5176 taskmgr.exe Token: 33 5176 taskmgr.exe Token: SeIncBasePriorityPrivilege 5176 taskmgr.exe - Suspicious use of FindShellTrayWindow 41 IoCs
pid Process 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe - Suspicious use of SendNotifyMessage 41 IoCs
pid Process 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe 5176 taskmgr.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 444 wrote to memory of 3112 444 StealthBeacon.exe 79 PID 444 wrote to memory of 1200 444 StealthBeacon.exe 82 PID 444 wrote to memory of 3124 444 StealthBeacon.exe 84 PID 444 wrote to memory of 3076 444 StealthBeacon.exe 86 PID 444 wrote to memory of 5360 444 StealthBeacon.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\StealthBeacon.exe"C:\Users\Admin\AppData\Local\Temp\StealthBeacon.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:444 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c i7i(i/i!i-i)2⤵PID:3112
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c i7i(i/i!i-i)2⤵PID:1200
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c i7i(i/i!i-i)2⤵PID:3124
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c i7i(i/i!i-i)2⤵PID:3076
-
-
C:\Windows\SYSTEM32\cmd.execmd.exe /c i7i(i/i!i-i)2⤵PID:5360
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5176