Overview

overview

10

Static

static

??????????...md.exe

windows7_x64

10

??????????...md.exe

windows10_x64

10

Analysis

  • max time kernel
    78s
  • max time network
    143s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    22-09-2021 21:07

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ????????????????.cmd.exe

  • Size

    1.2MB

  • MD5

    57523bab2ccf571fcecc172ea5f44959

  • SHA1

    b214a6cc13e5022779b6ecaf0364a0464defa4ca

  • SHA256

    ce2b941076f27243a2ef984e5d6b045c505a98bc73a5a3b1152112228079e68b

  • SHA512

    197da439cac7e8eb38e60f4be9f832ac91d9b88cc5021ac9036822f87dfb9cb8c72171bceb7b1e5034074ae5de0cb40e2d60c3d73f9820cbd73c4ffeac0ae979

Score
10/10
chinese_generic_botnetbotnet

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Chinese Botnet Payload 1 IoCs
    botnet
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\________________.cmd.exe
    "C:\Users\Admin\AppData\Local\Temp\________________.cmd.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:1384
  • C:\Program Files (x86)\Dyydhdv.exe
    "C:\Program Files (x86)\Dyydhdv.exe"
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Program Files (x86)\Dyydhdv.exe
      "C:\Program Files (x86)\Dyydhdv.exe" Win7
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetWindowsHookEx
      PID:1312

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1384-55-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB

    Download

  • memory/1384-54-0x00000000768C1000-0x00000000768C3000-memory.dmp

    Filesize

    8KB

    Download