Analysis
-
max time kernel
176s -
max time network
226s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 18:30
Static task
static1
Behavioral task
behavioral1
Sample
06229461f5ee69ed2f1e7d0e0271aa0ad3eb25c90ea44d1fb3e7686d9beb9fd6.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
06229461f5ee69ed2f1e7d0e0271aa0ad3eb25c90ea44d1fb3e7686d9beb9fd6.exe
Resource
win10v2004-20220414-en
General
-
Target
06229461f5ee69ed2f1e7d0e0271aa0ad3eb25c90ea44d1fb3e7686d9beb9fd6.exe
-
Size
564KB
-
MD5
61e785490e498db5653d21823f2e818c
-
SHA1
ebcd9bbc603184ecaa24373a5c997bae2d9b9a0f
-
SHA256
06229461f5ee69ed2f1e7d0e0271aa0ad3eb25c90ea44d1fb3e7686d9beb9fd6
-
SHA512
a147836bdbe9dd381e7f9ed143f039d3ca8d426cde261949971072bc72a222e79ea993adaf3c9cb89674a882e2ffdc6f7fe50c2bc27dcd674735a13fb3f7c076
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral1/memory/324-55-0x0000000010000000-0x0000000010012000-memory.dmp unk_chinese_botnet -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\kequas = "C:\\Users\\Admin\\AppData\\Local\\Temp\\06229461f5ee69ed2f1e7d0e0271aa0ad3eb25c90ea44d1fb3e7686d9beb9fd6.exe" 06229461f5ee69ed2f1e7d0e0271aa0ad3eb25c90ea44d1fb3e7686d9beb9fd6.exe