Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
18-08-2022 13:54
Static task
static1
Behavioral task
behavioral1
Sample
Server_se.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Server_se.exe
Resource
win10v2004-20220812-en
General
-
Target
Server_se.exe
-
Size
1.3MB
-
MD5
568563501bedc44175d2218a59a43a02
-
SHA1
8589da7010602a88a1caaa7e07382a1c1b35a453
-
SHA256
31fc16d69939d4b8b18df3d0781b38aedfb4520ad14befa70d64d4f72e27bee6
-
SHA512
7c81452c5a892e789d5bb41df5ea3b9a18ecb8b4b3289f42fb791a21155a34a628a5dff1fbee41325aee11d0e9bfc25630d7f20c9b3ec6a90aed2df10de421fb
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1788-4824-0x0000000000400000-0x00000000005E5000-memory.dmp unk_chinese_botnet -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
Server_se.exedescription ioc process File opened (read-only) \??\W: Server_se.exe File opened (read-only) \??\J: Server_se.exe File opened (read-only) \??\K: Server_se.exe File opened (read-only) \??\N: Server_se.exe File opened (read-only) \??\Q: Server_se.exe File opened (read-only) \??\S: Server_se.exe File opened (read-only) \??\U: Server_se.exe File opened (read-only) \??\E: Server_se.exe File opened (read-only) \??\F: Server_se.exe File opened (read-only) \??\Z: Server_se.exe File opened (read-only) \??\V: Server_se.exe File opened (read-only) \??\X: Server_se.exe File opened (read-only) \??\O: Server_se.exe File opened (read-only) \??\P: Server_se.exe File opened (read-only) \??\R: Server_se.exe File opened (read-only) \??\T: Server_se.exe File opened (read-only) \??\G: Server_se.exe File opened (read-only) \??\I: Server_se.exe File opened (read-only) \??\L: Server_se.exe File opened (read-only) \??\M: Server_se.exe File opened (read-only) \??\Y: Server_se.exe File opened (read-only) \??\B: Server_se.exe File opened (read-only) \??\H: Server_se.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 27 IoCs
Processes:
Server_se.exepid process 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe 1788 Server_se.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
Server_se.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Server_se.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Server_se.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Server_se.exepid process 1788 Server_se.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Server_se.exepid process 1788 Server_se.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Server_se.exe"C:\Users\Admin\AppData\Local\Temp\Server_se.exe"1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1788-54-0x00000000761F1000-0x00000000761F3000-memory.dmpFilesize
8KB
-
memory/1788-56-0x0000000075E20000-0x0000000075E67000-memory.dmpFilesize
284KB
-
memory/1788-461-0x0000000000400000-0x00000000005E5000-memory.dmpFilesize
1.9MB
-
memory/1788-463-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-464-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-465-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-466-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-467-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-468-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-469-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-470-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-471-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-472-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-473-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-474-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-475-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-476-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-477-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-478-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-479-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-480-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-481-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-482-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-483-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-484-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-485-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-486-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-487-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-488-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-489-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-490-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-491-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-492-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-493-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-494-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-495-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-496-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-497-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-498-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-499-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-500-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-501-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-502-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-503-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-504-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-505-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-506-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-507-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-508-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-509-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-510-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-511-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-512-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-513-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-514-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-515-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-516-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-517-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-518-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-519-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-520-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-522-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-521-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-523-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-524-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-1468-0x00000000005F0000-0x00000000006F0000-memory.dmpFilesize
1024KB
-
memory/1788-1469-0x00000000020A0000-0x0000000002221000-memory.dmpFilesize
1.5MB
-
memory/1788-4817-0x0000000002230000-0x0000000002341000-memory.dmpFilesize
1.1MB
-
memory/1788-4818-0x0000000000400000-0x00000000005E5000-memory.dmpFilesize
1.9MB
-
memory/1788-4819-0x0000000002350000-0x0000000002451000-memory.dmpFilesize
1.0MB
-
memory/1788-4823-0x00000000005F0000-0x00000000006F0000-memory.dmpFilesize
1024KB
-
memory/1788-4824-0x0000000000400000-0x00000000005E5000-memory.dmpFilesize
1.9MB