Overview

overview

10

Static

static

震惊！2...at.exe

windows7_x64

10

震惊！2...at.exe

windows10_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    22-09-2021 20:58

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    震惊！20岁美女在“柬埔寨”被2名推广男轮奸分尸视频.bat.exe

  • Size

    2.1MB

  • MD5

    ff64906b11528c53152738a2bd6c9caf

  • SHA1

    fe4abda528c86c99d3216d4bc0148e59ab579dcb

  • SHA256

    fcf27e26346dcf0dc51de742d85f75ca0e56d89cba70932b90dd4d11311e38b9

  • SHA512

    ab22a94f3a3014e35d721696294ebfe1d2c72dee031b5ce8c5e349cf824e4533b1fcf4f36e6b0d12c6977bd0af98c3826f36f58ee6f19eb9d848cee15bfbfbae

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Chinese Botnet Payload 1 IoCs
    botnet
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\震惊！20岁美女在“柬埔寨”被2名推广男轮奸分尸视频.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\震惊！20岁美女在“柬埔寨”被2名推广男轮奸分尸视频.bat.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates connected drives
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:2384

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2384-115-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB

    Download