chinese_generic_botnet | 53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

General

Target

eufive_20210808-125605.exe
Size

325KB
MD5

94b43aaf8dd6506835fd99917a412b9f
SHA1

17eb10f6f986eff21f49586b06e844784ab66dab
SHA256

53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60
SHA512

614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet Payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/368-57-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

Processes:

Wakkeos.exeWakkeos.exe

pid process

2044 Wakkeos.exe
1612 Wakkeos.exe

pid	process
2044	Wakkeos.exe
1612	Wakkeos.exe

Drops file in System32 directory 2 IoCs

Processes:

Wakkeos.exeWakkeos.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Wakkeos.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Wakkeos.exe

Drops file in Program Files directory 2 IoCs

Processes:

eufive_20210808-125605.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe	eufive_20210808-125605.exe
File opened for modification	C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe	eufive_20210808-125605.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 49 IoCs

Processes:

Wakkeos.exeWakkeos.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDecision = "0"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadDecisionTime = 20bb0305feadd701	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\82-6d-d3-5b-b4-3a	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDecisionTime = 20bb0305feadd701	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadDecisionReason = "1"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDecision = "0"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDecisionTime = 8039e00dfeadd701	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDetectedUrl	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadDecisionTime = 8039e00dfeadd701	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadDecision = "0"	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDecisionReason = "1"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadDecisionReason = "1"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadNetworkName = "Network 3"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadNetworkName = "Network 3"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Wakkeos.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\82-6d-d3-5b-b4-3a	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}\WpadDecision = "0"	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Wakkeos.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDecisionTime = 20bb0305feadd701	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{697BA2EB-696A-4989-97EC-802A43BAD80D}	Wakkeos.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Wakkeos.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\82-6d-d3-5b-b4-3a\WpadDecisionReason = "1"	Wakkeos.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

eufive_20210808-125605.exeWakkeos.exeWakkeos.exe

pid process

368 eufive_20210808-125605.exe
2044 Wakkeos.exe
1612 Wakkeos.exe

pid	process
368	eufive_20210808-125605.exe
2044	Wakkeos.exe
1612	Wakkeos.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Wakkeos.exe

description	pid	process	target process
PID 2044 wrote to memory of 1612	2044	Wakkeos.exe	Wakkeos.exe
PID 2044 wrote to memory of 1612	2044	Wakkeos.exe	Wakkeos.exe
PID 2044 wrote to memory of 1612	2044	Wakkeos.exe	Wakkeos.exe
PID 2044 wrote to memory of 1612	2044	Wakkeos.exe	Wakkeos.exe

C:\Users\Admin\AppData\Local\Temp\eufive_20210808-125605.exe
"C:\Users\Admin\AppData\Local\Temp\eufive_20210808-125605.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of SetWindowsHookEx
PID:368

C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe
"C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe
  "C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1612

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe

MD5
94b43aaf8dd6506835fd99917a412b9f

SHA1
17eb10f6f986eff21f49586b06e844784ab66dab

SHA256
53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

SHA512
614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Download Submit
C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe

MD5
94b43aaf8dd6506835fd99917a412b9f

SHA1
17eb10f6f986eff21f49586b06e844784ab66dab

SHA256
53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

SHA512
614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Download Submit
C:\Program Files (x86)\Microsoft Egkgcm\Wakkeos.exe

MD5
94b43aaf8dd6506835fd99917a412b9f

SHA1
17eb10f6f986eff21f49586b06e844784ab66dab

SHA256
53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60

SHA512
614cd22f7ac4afa103a8995dbb30ae83f48156ba7759ab402e9929dcc7033c793b1aac6108ca8a29973ed552507f7e98a884000392c46137c9fdf183ade96797

Download Submit
memory/368-54-0x0000000000300000-0x00000000003BC000-memory.dmp

Filesize
752KB

Download
memory/368-55-0x0000000000400000-0x0000000002C87000-memory.dmp

Filesize
40.5MB

Download
memory/368-56-0x0000000076001000-0x0000000076003000-memory.dmp

Filesize
8KB

Download
memory/368-57-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1612-65-0x0000000000000000-mapping.dmp

Download
memory/1612-67-0x0000000000400000-0x0000000002C87000-memory.dmp

Filesize
40.5MB

Download
memory/2044-60-0x0000000000400000-0x0000000002C87000-memory.dmp

Filesize
40.5MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads