chinese_generic_botnet | 0ef8fb38811c876792a8cc7832def5e5905df0c253ecc47998c18bc8ffb280cc

Analysis

Target

0ef8fb38811c876792a8cc7832def5e5905df0c253ecc47998c18bc8ffb280cc.exe
Size

728KB
MD5

dd2bca6daf4308b18afd9055b0584789
SHA1

67b997184106a4e238663d9ab7b2d1869b3869e4
SHA256

0ef8fb38811c876792a8cc7832def5e5905df0c253ecc47998c18bc8ffb280cc
SHA512

44f8653930f54b8dbfce192569f2e83e08f513945eb0be564458e256228484e607188979ad093c590d0ebf9e917c158d124ae319e9fc01f4233a0378710def14

Score

10^/10

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet Payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/976-55-0x0000000010000000-0x0000000010017000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

pid	Process
320	Yeqaess.exe
1492	Yeqaess.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Yeqaess.exe	0ef8fb38811c876792a8cc7832def5e5905df0c253ecc47998c18bc8ffb280cc.exe
File opened for modification	C:\Program Files (x86)\Yeqaess.exe	0ef8fb38811c876792a8cc7832def5e5905df0c253ecc47998c18bc8ffb280cc.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
976	0ef8fb38811c876792a8cc7832def5e5905df0c253ecc47998c18bc8ffb280cc.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
976	0ef8fb38811c876792a8cc7832def5e5905df0c253ecc47998c18bc8ffb280cc.exe
320	Yeqaess.exe
1492	Yeqaess.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 320 wrote to memory of 1492	320	Yeqaess.exe	28
PID 320 wrote to memory of 1492	320	Yeqaess.exe	28
PID 320 wrote to memory of 1492	320	Yeqaess.exe	28
PID 320 wrote to memory of 1492	320	Yeqaess.exe	28

memory/976-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/976-55-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download