General

  • Target

    tmp

  • Size

    1MB

  • Sample

    220914-1x4qhsbdb2

  • MD5

    d6df53506b123f5717463d0355336979

  • SHA1

    7720fb4b89a4ebcef32a6d6a9a7a88c65cad2c14

  • SHA256

    70969f1d56ec1ddcae3fc50545c0a351b798226c62d870db8ae5170eeec67694

  • SHA512

    1bfefa221ed77ef05fc72fbc20a322cae990b2a33a9af47b9ee4d9fa1c09d5c81f6a8fd8496ed43a47ee2862e1e2bf1651b4cca2f5e9e23e491c3d4b3249ad2f

  • SSDEEP

    12288:0MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Vih81hnr39hf:0nsJ39LyjbJkQFMhmC+6GD9Dnnj

Malware Config

Targets

    • Target

      tmp

    • Size

      1MB

    • MD5

      d6df53506b123f5717463d0355336979

    • SHA1

      7720fb4b89a4ebcef32a6d6a9a7a88c65cad2c14

    • SHA256

      70969f1d56ec1ddcae3fc50545c0a351b798226c62d870db8ae5170eeec67694

    • SHA512

      1bfefa221ed77ef05fc72fbc20a322cae990b2a33a9af47b9ee4d9fa1c09d5c81f6a8fd8496ed43a47ee2862e1e2bf1651b4cca2f5e9e23e491c3d4b3249ad2f

    • SSDEEP

      12288:0MSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9Vih81hnr39hf:0nsJ39LyjbJkQFMhmC+6GD9Dnnj

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

    • Chinese Botnet payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Discovery

Query Registry

4
T1012

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Tasks