Analysis
-
max time kernel
124s -
max time network
184s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
22-09-2021 20:59
General
-
Target
迪拜易彩公司女财务被轮奸致死视频流出.bat.exe
-
Size
1.5MB
-
MD5
169d4e1aa1dcb3e0ee55127e6134ba5a
-
SHA1
480819041f6d330c34414b8b4f21efef24baf60d
-
SHA256
807d64d7a9a6c61df643d03a7c8750c69e7f76bbb8ad9cb939a1af7c63f1471e
-
SHA512
1fda1a9cff8c912a6239060649f73f3cae7306c82935cb3c3e81537cc3616b6005d6052cfefafcf074a8e8533dde9573db91515b738a0565d6d9f4c52db077ba
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\迪拜易彩公司女财务被轮奸致死视频流出.bat.exe"C:\Users\Admin\AppData\Local\Temp\迪拜易彩公司女财务被轮奸致死视频流出.bat.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB