Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
10-10-2022 07:29
Static task
static1
Behavioral task
behavioral1
Sample
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe
Resource
win10-20220812-en
General
-
Target
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe
-
Size
880KB
-
MD5
53460de37325b4979177f832ae51f9de
-
SHA1
f32dd3e711e5fc24c3e525ab835c83588cbc1558
-
SHA256
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1
-
SHA512
19a489017baaa2adb1c9cf75a502725a28193e4a0661b8f7956169084884e82e07d9b980091d1f8c307cb6f7ae7e7bb3fd3012db0a30dedbe30621f1f60f1595
-
SSDEEP
24576:7stUx5NK+HjoSIIJ2thqogNSNOKt5apf7xesN7:gtIS+dJgRkSNO0Qpow
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2684-7054-0x0000000000400000-0x0000000000529000-memory.dmp unk_chinese_botnet -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1099808672-3828198950-1535142148-1000\Software\Microsoft\Windows\CurrentVersion\Run\Ecigfam.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe" bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exedescription ioc process File opened (read-only) \??\G: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\N: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\W: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\Y: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\B: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\L: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\R: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\S: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\J: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\M: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\O: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\P: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\T: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\U: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\H: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\F: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\I: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\K: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\Q: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\V: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\X: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\Z: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe File opened (read-only) \??\E: bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 36 IoCs
Processes:
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exepid process 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exepid process 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exedescription pid process target process PID 2684 wrote to memory of 3340 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe cmd.exe PID 2684 wrote to memory of 3340 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe cmd.exe PID 2684 wrote to memory of 3340 2684 bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe"C:\Users\Admin\AppData\Local\Temp\bb10d1876255ac5c7beb971b9c3f748976eef78067690392f36e698939331ac1.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c md C:\windowss642⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2684-155-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-2919-0x0000000074A00000-0x0000000074A77000-memory.dmpFilesize
476KB
-
memory/2684-121-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-122-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-123-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-119-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-125-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-126-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-127-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-128-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/2684-129-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-130-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-131-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-132-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-133-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-134-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-135-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-136-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-137-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-138-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-139-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-140-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-141-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-142-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-143-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-144-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-146-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-145-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-147-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-148-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-149-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-150-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-151-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-152-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-153-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-154-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-124-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-156-0x00000000753C0000-0x0000000075582000-memory.dmpFilesize
1.8MB
-
memory/2684-120-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-2490-0x00000000028F0000-0x0000000002AC2000-memory.dmpFilesize
1.8MB
-
memory/2684-2492-0x0000000002580000-0x0000000002714000-memory.dmpFilesize
1.6MB
-
memory/2684-2022-0x00000000747B0000-0x00000000748EC000-memory.dmpFilesize
1.2MB
-
memory/2684-7020-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/2684-7021-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/2684-7023-0x00000000023E0000-0x0000000002575000-memory.dmpFilesize
1.6MB
-
memory/2684-7024-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/2684-7031-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7032-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/2684-7033-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7034-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7035-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7054-0x0000000000400000-0x0000000000529000-memory.dmpFilesize
1.2MB
-
memory/2684-7036-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7037-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7038-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7039-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7040-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7041-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7042-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7043-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7044-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7045-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7046-0x00000000028F0000-0x0000000002AC2000-memory.dmpFilesize
1.8MB
-
memory/2684-7047-0x0000000002580000-0x0000000002714000-memory.dmpFilesize
1.6MB
-
memory/2684-7048-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7049-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/2684-7053-0x00000000023E0000-0x0000000002575000-memory.dmpFilesize
1.6MB
-
memory/3340-7025-0x0000000000000000-mapping.dmp
-
memory/3340-7027-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/3340-7026-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/3340-7028-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/3340-7029-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/3340-7030-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB