chinese_generic_botnet | 22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82

Analysis

max time kernel
137s
max time network
154s
platform
windows7_x64
resource
win7-20220414-en
submitted
11/05/2022, 14:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe
Size

156KB
MD5

2125f0d203d4ad5bfdb0ef158ada3995
SHA1

ecfd879faf4f047541147617cb84a9638600212d
SHA256

22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82
SHA512

ad301008fe4d5400f5b63beedbf654c0b61d06fa2d4083293925cba1d786712e094866c7c6dbffce4394c72dc5fbcd21025d04c33dde5668b0c1347cf6b9deb7

Score

10^/10

chinese_generic_botnet botnet persistence vmprotect

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet Payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/1992-55-0x0000000010000000-0x0000000010017000-memory.dmp	unk_chinese_botnet

VMProtect packed file 1 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/memory/1992-55-0x0000000010000000-0x0000000010017000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\Myamimk.exe"	22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Myamimk.exe	22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe
File opened for modification	C:\Windows\Myamimk.exe	22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1992	22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1992	22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe

C:\Users\Admin\AppData\Local\Temp\22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe
"C:\Users\Admin\AppData\Local\Temp\22e4f35818b256b89cd533718def4a707033dfa85814c5fbad5bf33f32280b82.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1992

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1992-54-0x0000000075FE1000-0x0000000075FE3000-memory.dmp

Filesize
8KB

Download
memory/1992-55-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download