chinese_generic_botnet | 53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

General

Target

eufive_20210808-125605.exe
Size

325KB
MD5

94b43aaf8dd6506835fd99917a412b9f
SHA1

17eb10f6f986eff21f49586b06e844784ab66dab
SHA256

53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60
SHA512

614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet Payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/1032-63-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

Processes:

Wakkeos.exeWakkeos.exe

pid process

1832 Wakkeos.exe
340 Wakkeos.exe

pid	process
1832	Wakkeos.exe
340	Wakkeos.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

eufive_20210808-125605.exe

description	ioc	process
File opened (read-only)	\??\O:	eufive_20210808-125605.exe
File opened (read-only)	\??\S:	eufive_20210808-125605.exe
File opened (read-only)	\??\V:	eufive_20210808-125605.exe
File opened (read-only)	\??\W:	eufive_20210808-125605.exe
File opened (read-only)	\??\I:	eufive_20210808-125605.exe
File opened (read-only)	\??\K:	eufive_20210808-125605.exe
File opened (read-only)	\??\L:	eufive_20210808-125605.exe
File opened (read-only)	\??\Q:	eufive_20210808-125605.exe
File opened (read-only)	\??\X:	eufive_20210808-125605.exe
File opened (read-only)	\??\U:	eufive_20210808-125605.exe
File opened (read-only)	\??\Y:	eufive_20210808-125605.exe
File opened (read-only)	\??\B:	eufive_20210808-125605.exe
File opened (read-only)	\??\F:	eufive_20210808-125605.exe
File opened (read-only)	\??\H:	eufive_20210808-125605.exe
File opened (read-only)	\??\J:	eufive_20210808-125605.exe
File opened (read-only)	\??\N:	eufive_20210808-125605.exe
File opened (read-only)	\??\P:	eufive_20210808-125605.exe
File opened (read-only)	\??\E:	eufive_20210808-125605.exe
File opened (read-only)	\??\G:	eufive_20210808-125605.exe
File opened (read-only)	\??\M:	eufive_20210808-125605.exe
File opened (read-only)	\??\R:	eufive_20210808-125605.exe
File opened (read-only)	\??\T:	eufive_20210808-125605.exe
File opened (read-only)	\??\Z:	eufive_20210808-125605.exe

Drops file in System32 directory 2 IoCs

Processes:

Wakkeos.exeWakkeos.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Wakkeos.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Wakkeos.exe

Drops file in Program Files directory 2 IoCs

Processes:

eufive_20210808-125605.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe	eufive_20210808-125605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe	eufive_20210808-125605.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

eufive_20210808-125605.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	eufive_20210808-125605.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	eufive_20210808-125605.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

Wakkeos.exeWakkeos.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDecision = "0"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDecisionTime = 00a32000478cd701	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\3a-52-03-3b-7d-07	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDecision = "0"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a070011000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDecisionReason = "1"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDetectedUrl	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 00b5e708478cd701	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDecisionTime = 00b5e708478cd701	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\3a-52-03-3b-7d-07	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = 00a32000478cd701	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDecisionReason = "1"	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-52-03-3b-7d-07\WpadDecisionTime = 00a32000478cd701	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0"	Wakkeos.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

eufive_20210808-125605.exe

pid process

1032 eufive_20210808-125605.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

eufive_20210808-125605.exeWakkeos.exeWakkeos.exe

pid process

1032 eufive_20210808-125605.exe
1832 Wakkeos.exe
340 Wakkeos.exe

pid	process
1032	eufive_20210808-125605.exe

pid	process
1032	eufive_20210808-125605.exe
1832	Wakkeos.exe
340	Wakkeos.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Wakkeos.exe

description	pid	process	target process
PID 1832 wrote to memory of 340	1832	Wakkeos.exe	Wakkeos.exe
PID 1832 wrote to memory of 340	1832	Wakkeos.exe	Wakkeos.exe
PID 1832 wrote to memory of 340	1832	Wakkeos.exe	Wakkeos.exe
PID 1832 wrote to memory of 340	1832	Wakkeos.exe	Wakkeos.exe

C:\Users\Admin\AppData\Local\Temp\eufive_20210808-125605.exe
"C:\Users\Admin\AppData\Local\Temp\eufive_20210808-125605.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1032

C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe
"C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe
  "C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:340

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe

MD5
94b43aaf8dd6506835fd99917a412b9f

SHA1
17eb10f6f986eff21f49586b06e844784ab66dab

SHA256
53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

SHA512
614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Download Submit
C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe

MD5
94b43aaf8dd6506835fd99917a412b9f

SHA1
17eb10f6f986eff21f49586b06e844784ab66dab

SHA256
53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

SHA512
614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Download Submit
C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe

MD5
94b43aaf8dd6506835fd99917a412b9f

SHA1
17eb10f6f986eff21f49586b06e844784ab66dab

SHA256
53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

SHA512
614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Download Submit
memory/340-71-0x0000000000000000-mapping.dmp

Download
memory/340-76-0x0000000000400000-0x0000000002C87000-memory.dmp

Filesize
40.5MB

Download
memory/1032-60-0x0000000000310000-0x00000000003CC000-memory.dmp

Filesize
752KB

Download
memory/1032-61-0x0000000000400000-0x0000000002C87000-memory.dmp

Filesize
40.5MB

Download
memory/1032-62-0x0000000075591000-0x0000000075593000-memory.dmp

Filesize
8KB

Download
memory/1032-63-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1832-66-0x0000000000400000-0x0000000002C87000-memory.dmp

Filesize
40.5MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads