Resubmissions
22/09/2021, 03:40
210922-d8nr4sbad51020/09/2021, 08:58
210920-kxhv2sdec51008/08/2021, 11:12
210808-6klsp4qpxn8Analysis
- max time kernel
149s - max time network
151s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
22/09/2021, 03:40
General
- Target eufive_20210808-125605.exe
- Size 325KB
- Sample210922-d8nr4sbad5
- SHA256 53b9a0465f0f42c412ba90058ed129e7e6c4c97f724f537a7e03c9931c8bbc60
Score
10/10
Malware Config
Signatures
- Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
- Chinese Botnet Payload 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eufive_20210808-125605.exe"C:\Users\Admin\AppData\Local\Temp\eufive_20210808-125605.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2060-115-0x0000000004890000-0x000000000494C000-memory.dmp
memory/2060-116-0x0000000000400000-0x0000000002C87000-memory.dmp
memory/2060-117-0x0000000010000000-0x0000000010018000-memory.dmp