Analysis
-
max time kernel
75s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
22-09-2021 21:10
General
-
Target
行贿警察、组织卖淫、开设赌场，攫金6_5亿的“黑金帝国”.cmd.exe
-
Size
2.0MB
-
MD5
0889ac4ebfcc906fa3dc17f3a97862da
-
SHA1
dcf4239b4535a3bc4a2a83fadab113984421d086
-
SHA256
07ebb19e273995bef00aa19ad538b5cacb5eb0527288c3f5a31be66bfc1d9bb9
-
SHA512
419d4c89cd9607e2140b0f1eb49c47ed2a0998d40777914bf5b443e5c6906da875407f769b286da390b36f19fcdd9411dd0b6583e3513d1460d3e11533e45bf3
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 1 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\行贿警察、组织卖淫、开设赌场，攫金6_5亿的“黑金帝国”.cmd.exe"C:\Users\Admin\AppData\Local\Temp\行贿警察、组织卖淫、开设赌场，攫金6_5亿的“黑金帝国”.cmd.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
96KB