Analysis

  • max time kernel
    61s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-09-2022 11:15

General

  • Target

    tmp.exe

  • Size

    636KB

  • MD5

    d78e432596860d422a790aaeb88656d1

  • SHA1

    501d5a13d4a2b1e1c96cda905be18472c46a7f74

  • SHA256

    889b8e0b10272ec7328892a98d78ad017f6f55740fab6e89fda86b776cd31c03

  • SHA512

    de6e05961a3056afdf96fc81f133574e249ccc3e50a417413424bbef349cb185372a4f076adff4e3c896e1e43e818aecbf7c284cf3212c6ab2923956b16bc827

  • SSDEEP

    12288:JOQrgeTVH0pp3WcjDRyXcC8K2UU22/HoFN6WtljaElIaY:J158maCDi/HoFN6WtljaEyaY

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Chinese Botnet payload ⋅ 2 IoCs
  • Enumerates connected drives ⋅ 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry ⋅ 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
    Enumerates connected drives
    Checks processor information in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of SetWindowsHookEx
    PID:4628

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                      Privilege Escalation

                        Replay Monitor

                        00:00 00:00

                        Downloads

                        • memory/4628-132-0x0000000000400000-0x000000000055E000-memory.dmp
                        • memory/4628-133-0x0000000000710000-0x000000000074E000-memory.dmp
                        • memory/4628-134-0x0000000002340000-0x0000000002345000-memory.dmp
                        • memory/4628-135-0x0000000010000000-0x0000000010018000-memory.dmp
                        • memory/4628-138-0x0000000000400000-0x000000000055E000-memory.dmp