Overview

overview

9

Static

static

3

WatchBeam.exe

windows11-21h2-x64

9

$PLUGINSDI...ls.dll

windows11-21h2-x64

3

$PLUGINSDI...em.dll

windows11-21h2-x64

3

$PLUGINSDIR/UAC.dll

windows11-21h2-x64

3

$PLUGINSDI...ll.dll

windows11-21h2-x64

3

resources/...art.js

windows11-21h2-x64

3

resources/...ons.js

windows11-21h2-x64

3

resources/...dex.js

windows11-21h2-x64

3

resources/...ect.js

windows11-21h2-x64

3

resources/...gen.py

windows11-21h2-x64

3

resources/...gen.py

windows11-21h2-x64

3

resources/...gen.py

windows11-21h2-x64

3

resources/...oke.js

windows11-21h2-x64

3

resources/...der.js

windows11-21h2-x64

3

resources/...dex.js

windows11-21h2-x64

3

resources/...ols.js

windows11-21h2-x64

3

resources/...nit.js

windows11-21h2-x64

3

resources/...nes.js

windows11-21h2-x64

3

resources/...inl.js

windows11-21h2-x64

3

resources/...e3.dll

windows11-21h2-x64

1

resources/...act.js

windows11-21h2-x64

3

resources/...ing.js

windows11-21h2-x64

3

resources/...te3.js

windows11-21h2-x64

3

resources/...ace.js

windows11-21h2-x64

3

resources/...kup.js

windows11-21h2-x64

3

resources/elevate.exe

windows11-21h2-x64

3

vk_swiftshader.dll

windows11-21h2-x64

1

vulkan-1.dll

windows11-21h2-x64

1

$PLUGINSDI...gs.dll

windows11-21h2-x64

3

$PLUGINSDI...ec.dll

windows11-21h2-x64

3

$PLUGINSDI...7z.dll

windows11-21h2-x64

3

$R0/Uninst...am.exe

windows11-21h2-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target
    WatchBeam.exe
  • Size 114.2MB
  • Sample260625-taqf2sdv4q
  • SHA256 1a3609e76ee85d9b0f4eb11e79d3dc0d1b401c1c967ad34825120ec267b2374e
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexecutionpersistencespywarestealer

Malware Config

Targets

    • Target
      WatchBeam.exe
    • Size 114.2MB
    • SHA256 1a3609e76ee85d9b0f4eb11e79d3dc0d1b401c1c967ad34825120ec267b2374e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    9/10
    defense_evasiondiscoveryexecutionpersistencespywarestealer

    • Enumerates VirtualBox registry keys

      defense_evasion

    • Identifies VirtualBox via ACPI registry values (likely anti-VM)

      defense_evasion

    • Looks for VirtualBox Guest Additions in registry

      defense_evasion

    • Looks for VMWare Tools registry key

      defense_evasion

    • Looks for VMWare services registry key.

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Enumerates processes with tasklist

      discovery
    behavioral1
    • Target
      $PLUGINSDIR/StdUtils.dll
    • Size 100KB
    • SHA256 b72e9013a6204e9f01076dc38dabbf30870d44dfc66962adbf73619d4331601e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral2
    • Target
      $PLUGINSDIR/System.dll
    • Size 12KB
    • SHA256 3eb38ae99653a7dbc724132ee240f6e5c4af4bfe7c01d31d23faf373f9f2eaca
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral3
    • Target
      $PLUGINSDIR/UAC.dll
    • Size 14KB
    • SHA256 2f7f8fc05dc4fd0d5cda501b47e4433357e887bbfed7292c028d99c73b52dc08
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral4
    • Target
      $PLUGINSDIR/WinShell.dll
    • Size 3KB
    • SHA256 9be85b986ea66a6997dde658abe82b3147ed2a1a3dcb784bb5176f41d22815a6
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    discovery
    behavioral5
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/start.md
    • Size 3KB
    • SHA256 2624333facf7f80b21c6d422ecc9289dc069577e5f946f468eeecb4fde62205f
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral6
    • Target
      resources/app.asar.unpacked/node_modules/koffi/doc/unions.md
    • Size 5KB
    • SHA256 2adf36a1ce803786036fa7ee9cfd4ceca2f62cd6e0560554ce49315cbc67674d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral7
    • Target
      resources/app.asar.unpacked/node_modules/koffi/index.js
    • Size 20KB
    • SHA256 39e05b73cec3a65d5841906b97cb8c95055e6fb300271de0c0b5a7f918f2ca80
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral8
    • Target
      resources/app.asar.unpacked/node_modules/koffi/indirect.js
    • Size 18KB
    • SHA256 375321335528e603091398dea286361aa8ca045ce7f76bf99dce7c92b768cbfa
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral9
    • Target
      resources/app.asar.unpacked/node_modules/koffi/lib/native/base/crc_gen.py
    • Size 2KB
    • SHA256 605109bcb12c06748b022bb1a7948fe5e4c6376bc87b21d232fca9b1d9a241ec
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral10
    • Target
      resources/app.asar.unpacked/node_modules/koffi/lib/native/base/mimetypes_gen.py
    • Size 1KB
    • SHA256 18e93987189889bed91f06b27ea80e16241ddb59f32409dae160cc54356f6236
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    behavioral11
    • Target
      resources/app.asar.unpacked/node_modules/koffi/lib/native/base/unicode_gen.py
    • Size 4KB
    • SHA256 402e17c0b48c4d79da1234e10e57d7174b9103c376dd43ad9a1e044a9fb39944
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    behavioral12
    • Target
      resources/app.asar.unpacked/node_modules/koffi/src/cnoke/cnoke.js
    • Size 6KB
    • SHA256 dfa8d4d5a1e7e4cdd51ac2b656b93e816718d5912dcaa28002bf3d6cb3068b46
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral13
    • Target
      resources/app.asar.unpacked/node_modules/koffi/src/cnoke/src/builder.js
    • Size 17KB
    • SHA256 53a48af14d00256f3f60d6265d8bc637fe1fe50e0cbebb3ecc610bd9cc46b199
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral14
    • Target
      resources/app.asar.unpacked/node_modules/koffi/src/cnoke/src/index.js
    • Size 247B
    • SHA256 01cdd6266047bdf69d79c0ea48fdcd830471282eddc0b9c8259558baaff62cd7
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral15
    • Target
      resources/app.asar.unpacked/node_modules/koffi/src/cnoke/src/tools.js
    • Size 12KB
    • SHA256 7b12a3ddc0a7706b7e5cc6155537e9abf3c75c124e5ca38ab58c8dc0b8eea58a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral16
    • Target
      resources/app.asar.unpacked/node_modules/koffi/src/koffi/src/init.js
    • Size 3KB
    • SHA256 76c95aba02c0e8b2df4a0580af41c65f5a2fab8dbbc86cc02e6eb177268d0d9b
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral17
    • Target
      resources/app.asar.unpacked/node_modules/koffi/src/koffi/tools/write_trampolines.js
    • Size 1KB
    • SHA256 3ab8e2ca421a950555b9866396ea9d2632d3a70d5674096a20968fd0458cfd7d
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral18
    • Target
      resources/app.asar.unpacked/node_modules/koffi/vendor/node-addon-api/napi-inl.h
    • Size 230KB
    • SHA256 797668948d7f2df0ee8fcfe734af5b55942768bc7e15e77196a1f1107bba3635
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral19
    • Target
      resources/app.asar.unpacked/node_modules/sqlite3/build/Release/node_sqlite3.node
    • Size 1.8MB
    • SHA256 f806f89dc41dde00ca7124dc1e649bdc9b08ff2eff5c891b764f3e5aefa9548c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral20
    • Target
      resources/app.asar.unpacked/node_modules/sqlite3/deps/extract.js
    • Size 224B
    • SHA256 5be353d29c0fabea29cfd34448c196da9506009c0b20fde55e01d4191941dd74
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral21
    • Target
      resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3-binding.js
    • Size 59B
    • SHA256 762c7a74d7f92860a3873487b68e89f654a21d2aaeae9524eab5de9c65e66a9c
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral22
    • Target
      resources/app.asar.unpacked/node_modules/sqlite3/lib/sqlite3.js
    • Size 6KB
    • SHA256 8d6b400ae7f69a80d0cdd37a968d7b9a913661fa53475e5b8de49dda21684973
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral23
    • Target
      resources/app.asar.unpacked/node_modules/sqlite3/lib/trace.js
    • Size 1KB
    • SHA256 d06caec6136120c6fb7ee3681b1ca949e8b634e747ea8d3080c90f35aeb7728f
    • MD5 SHA1 SHA512 TLSH
    Score
    3/10
    execution
    behavioral24
    • Target
      resources/app.asar.unpacked/node_modules/sqlite3/src/backup.h
    • Size 6KB
    • SHA256 556ba9af78010f41bc6b5b806743dc728bc181934bf8a7c6e5d606f9b8c7a2e9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    execution
    behavioral25
    • Target
      resources/elevate.exe
    • Size 105KB
    • SHA256 9b1fbf0c11c520ae714af8aa9af12cfd48503eedecd7398d8992ee94d1b4dc37
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral26
    • Target
      vk_swiftshader.dll
    • Size 5.3MB
    • SHA256 c1a23152c6f6ba2acfdf18d1abb9ac9d4ed386db7324a4adf7d78ee532e11de0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral27
    • Target
      vulkan-1.dll
    • Size 904KB
    • SHA256 3adef87fbec27706c1da5eed0393a607f60bf7ca949a47b848ab3e2f4c26440a
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral28
    • Target
      $PLUGINSDIR/nsDialogs.dll
    • Size 9KB
    • SHA256 1e40211af65923c2f4fd02ce021458a7745d28e2f383835e3015e96575632172
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral29
    • Target
      $PLUGINSDIR/nsExec.dll
    • Size 6KB
    • SHA256 5d9ceb1ce5f35aea5f9e5a0c0edeeec04dfefe0c77890c80c70e98209b58b962
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral30
    • Target
      $PLUGINSDIR/nsis7z.dll
    • Size 424KB
    • SHA256 b393f05e8ff919ef071181050e1873c9a776e1a0ae8329aefff7007d0cadf592
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    3/10
    discovery
    behavioral31
    • Target
      $R0/Uninstall WatchBeam.exe
    • Size 183KB
    • SHA256 b44c4f7918279aaecbd2b92996da6523b0dcd002a860b99fa704ec4a4db2bcf0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    7/10
    defense_evasiondiscoveryexecution

    • Executes dropped EXE

    • Loads dropped DLL

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

2
T1059

JavaScript

1
T1059.007

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Hide Artifacts

1
T1564

Ignore Process Interrupts

1
T1564.011

Modify Registry

1
T1112

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Virtualization/Sandbox Evasion

5
T1497

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Browser Information Discovery

1
T1217

Process Discovery

1
T1057

Query Registry

6
T1012

System Information Discovery

3
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Virtualization/Sandbox Evasion

5
T1497

Lateral Movement

Collection

Data from Local System

2
T1005

Command and Control

Exfiltration

Impact

Tasks

static1

Score
3/10

behavioral1

defense_evasiondiscoveryexecutionpersistencespywarestealer
Score
9/10

behavioral2

discovery
Score
3/10

behavioral3

discovery
Score
3/10

behavioral4

discovery
Score
3/10

behavioral5

discovery
Score
3/10

behavioral6

execution
Score
3/10

behavioral7

execution
Score
3/10

behavioral8

execution
Score
3/10

behavioral9

execution
Score
3/10

behavioral10

Score
3/10

behavioral11

Score
3/10

behavioral12

Score
3/10

behavioral13

execution
Score
3/10

behavioral14

execution
Score
3/10

behavioral15

execution
Score
3/10

behavioral16

execution
Score
3/10

behavioral17

execution
Score
3/10

behavioral18

execution
Score
3/10

behavioral19

execution
Score
3/10

behavioral20

Score
1/10

behavioral21

execution
Score
3/10

behavioral22

execution
Score
3/10

behavioral23

execution
Score
3/10

behavioral24

execution
Score
3/10

behavioral25

execution
Score
3/10

behavioral26

discovery
Score
3/10

behavioral27

Score
1/10

behavioral28

Score
1/10

behavioral29

discovery
Score
3/10

behavioral30

discovery
Score
3/10

behavioral31

discovery
Score
3/10

behavioral32

defense_evasiondiscoveryexecution
Score
7/10