chinese_generic_botnet | 9aa1748979696921b27868393bbb69add33c1dbc89624ea3085119aaf76cc2e7

Analysis

max time kernel
145s
max time network
150s
platform
windows7_x64
resource
win7-en-20211208
submitted
15-12-2021 07:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

tmp/xp.exe
Size

1.3MB
MD5

80526cfb4316313ed339ca64368f5fae
SHA1

96507bec2754a51dca329bb73e2b2c56ce73e269
SHA256

9aa1748979696921b27868393bbb69add33c1dbc89624ea3085119aaf76cc2e7
SHA512

38155a4b8713e78c737108a1c6ff119b06832121d789bec0ced3f7fa140c07d6478c320a4f5fa97834a1ec67b7bb1d7ec8c890fd0934b7bc5c5fbc3f27e037d3

Score

10^/10

chinese_generic_botnet botnet evasion

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet Payload 2 IoCs

botnet

resource	yara_rule
behavioral1/memory/1668-55-0x0000000000400000-0x00000000007BD000-memory.dmp	unk_chinese_botnet
behavioral1/memory/860-80-0x0000000000400000-0x00000000007BD000-memory.dmp	unk_chinese_botnet

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Executes dropped EXE 1 IoCs

pid	Process
860	Jthrllf.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	xp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	xp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Jthrllf.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	Jthrllf.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Wine	xp.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Jthrllf.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1668	xp.exe
860	Jthrllf.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Jthrllf.exe	xp.exe
File opened for modification	C:\Program Files (x86)\Jthrllf.exe	xp.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f009a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Jthrllf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55FA078-758F-4FEE-80CC-20EC7480DBC3}\WpadDecisionTime = 301df7dc90f1d701	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Jthrllf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Jthrllf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Jthrllf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55FA078-758F-4FEE-80CC-20EC7480DBC3}	Jthrllf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55FA078-758F-4FEE-80CC-20EC7480DBC3}\WpadDecisionReason = "1"	Jthrllf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-8c-39-73-4f-7b\WpadDecisionReason = "1"	Jthrllf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Jthrllf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-8c-39-73-4f-7b\WpadDecisionTime = 301df7dc90f1d701	Jthrllf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-8c-39-73-4f-7b\WpadDecision = "0"	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-8c-39-73-4f-7b	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55FA078-758F-4FEE-80CC-20EC7480DBC3}\56-8c-39-73-4f-7b	Jthrllf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Jthrllf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55FA078-758F-4FEE-80CC-20EC7480DBC3}\WpadNetworkName = "Network 3"	Jthrllf.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Jthrllf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Jthrllf.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Jthrllf.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B55FA078-758F-4FEE-80CC-20EC7480DBC3}\WpadDecision = "0"	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Jthrllf.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Jthrllf.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1668	xp.exe
1668	xp.exe
860	Jthrllf.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1668	xp.exe

C:\Users\Admin\AppData\Local\Temp\tmp\xp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp\xp.exe"
1⤵
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:1668

C:\Program Files (x86)\Jthrllf.exe
"C:\Program Files (x86)\Jthrllf.exe"
1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:860

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/860-101-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/860-98-0x00000000043B0000-0x00000000043B1000-memory.dmp

Filesize
4KB

Download
memory/860-100-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/860-99-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/860-96-0x0000000004500000-0x0000000004501000-memory.dmp

Filesize
4KB

Download
memory/860-97-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/860-94-0x0000000004400000-0x0000000004401000-memory.dmp

Filesize
4KB

Download
memory/860-95-0x0000000004350000-0x0000000004351000-memory.dmp

Filesize
4KB

Download
memory/860-93-0x00000000042A0000-0x00000000042A1000-memory.dmp

Filesize
4KB

Download
memory/860-91-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/860-88-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/860-89-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/860-86-0x0000000004290000-0x0000000004292000-memory.dmp

Filesize
8KB

Download
memory/860-87-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/860-85-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/860-84-0x0000000004330000-0x0000000004331000-memory.dmp

Filesize
4KB

Download
memory/860-83-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/860-82-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/860-80-0x0000000000400000-0x00000000007BD000-memory.dmp

Filesize
3.7MB

Download
memory/860-81-0x0000000004360000-0x0000000004361000-memory.dmp

Filesize
4KB

Download
memory/1668-64-0x00000000042E0000-0x00000000042E1000-memory.dmp

Filesize
4KB

Download
memory/1668-67-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/1668-77-0x000000001000C000-0x0000000010012000-memory.dmp

Filesize
24KB

Download
memory/1668-75-0x0000000004280000-0x0000000004281000-memory.dmp

Filesize
4KB

Download
memory/1668-74-0x0000000004420000-0x0000000004421000-memory.dmp

Filesize
4KB

Download
memory/1668-73-0x0000000004440000-0x0000000004441000-memory.dmp

Filesize
4KB

Download
memory/1668-72-0x00000000043C0000-0x00000000043C1000-memory.dmp

Filesize
4KB

Download
memory/1668-71-0x0000000004520000-0x0000000004521000-memory.dmp

Filesize
4KB

Download
memory/1668-70-0x0000000004510000-0x0000000004511000-memory.dmp

Filesize
4KB

Download
memory/1668-69-0x0000000004360000-0x0000000004361000-memory.dmp

Filesize
4KB

Download
memory/1668-68-0x0000000004410000-0x0000000004411000-memory.dmp

Filesize
4KB

Download
memory/1668-76-0x0000000010001000-0x000000001000C000-memory.dmp

Filesize
44KB

Download
memory/1668-66-0x00000000042D0000-0x00000000042D1000-memory.dmp

Filesize
4KB

Download
memory/1668-54-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download
memory/1668-65-0x00000000042C0000-0x00000000042C1000-memory.dmp

Filesize
4KB

Download
memory/1668-63-0x0000000004300000-0x0000000004301000-memory.dmp

Filesize
4KB

Download
memory/1668-61-0x0000000004290000-0x0000000004292000-memory.dmp

Filesize
8KB

Download
memory/1668-62-0x0000000004380000-0x0000000004381000-memory.dmp

Filesize
4KB

Download
memory/1668-60-0x0000000004310000-0x0000000004311000-memory.dmp

Filesize
4KB

Download
memory/1668-59-0x0000000004340000-0x0000000004341000-memory.dmp

Filesize
4KB

Download
memory/1668-58-0x0000000004350000-0x0000000004351000-memory.dmp

Filesize
4KB

Download
memory/1668-57-0x00000000042F0000-0x00000000042F1000-memory.dmp

Filesize
4KB

Download
memory/1668-56-0x0000000004370000-0x0000000004371000-memory.dmp

Filesize
4KB

Download
memory/1668-55-0x0000000000400000-0x00000000007BD000-memory.dmp

Filesize
3.7MB

Download