chinese_generic_botnet | d7420275fec10fe9b857d9a7688e50e86534f0aab151c5e766fc74833f34e478

General

Target

Sr.exe
Size

1.0MB
MD5

6f4fc9a2f722fb24d5944c3720c8e086
SHA1

47b9064ae4db4974776bf8bd1bba8840b77124d2
SHA256

d7420275fec10fe9b857d9a7688e50e86534f0aab151c5e766fc74833f34e478
SHA512

6e3c4ebc7738115862e935b7cb18271969df1b2d54b49415d2500294b6391fb8f0dad0fe18bbeb69b865ecb40478ecad9c46e7b65c443e6445047164cf82f9e2
SSDEEP

6144:3yq9ptgIsxITrY0jTxx7B+G9gZ6Ae2y8Uk:vxgIsxITrLjlx7B+BZR2

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/1492-55-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

Processes:

Vqcttbn.exeVqcttbn.exe

pid process

520 Vqcttbn.exe
1124 Vqcttbn.exe

pid	process
520	Vqcttbn.exe
1124	Vqcttbn.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

Sr.exe

description	ioc	process
File opened (read-only)	\??\H:	Sr.exe
File opened (read-only)	\??\I:	Sr.exe
File opened (read-only)	\??\R:	Sr.exe
File opened (read-only)	\??\T:	Sr.exe
File opened (read-only)	\??\U:	Sr.exe
File opened (read-only)	\??\V:	Sr.exe
File opened (read-only)	\??\Y:	Sr.exe
File opened (read-only)	\??\E:	Sr.exe
File opened (read-only)	\??\J:	Sr.exe
File opened (read-only)	\??\O:	Sr.exe
File opened (read-only)	\??\W:	Sr.exe
File opened (read-only)	\??\B:	Sr.exe
File opened (read-only)	\??\G:	Sr.exe
File opened (read-only)	\??\L:	Sr.exe
File opened (read-only)	\??\N:	Sr.exe
File opened (read-only)	\??\Q:	Sr.exe
File opened (read-only)	\??\X:	Sr.exe
File opened (read-only)	\??\Z:	Sr.exe
File opened (read-only)	\??\F:	Sr.exe
File opened (read-only)	\??\K:	Sr.exe
File opened (read-only)	\??\M:	Sr.exe
File opened (read-only)	\??\P:	Sr.exe
File opened (read-only)	\??\S:	Sr.exe

Drops file in System32 directory 2 IoCs

Processes:

Vqcttbn.exeVqcttbn.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Vqcttbn.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Vqcttbn.exe

Drops file in Program Files directory 2 IoCs

Processes:

Sr.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe	Sr.exe
File opened for modification	C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe	Sr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Sr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Sr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Sr.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

Vqcttbn.exeVqcttbn.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecision = "0"	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionTime = 9008e6eb48e0d801	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionReason = "1"	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionTime = 9008e6eb48e0d801	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\d6-a6-83-9c-54-3e	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecision = "0"	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadNetworkName = "Network 3"	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionTime = b0a15ff548e0d801	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecision = "0"	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\d6-a6-83-9c-54-3e	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionReason = "1"	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDetectedUrl	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0084000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionReason = "1"	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionReason = "1"	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\d6-a6-83-9c-54-3e\WpadDecisionTime = 9008e6eb48e0d801	Vqcttbn.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecisionTime = b0a15ff548e0d801	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Vqcttbn.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadNetworkName = "Network 3"	Vqcttbn.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Vqcttbn.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{B8C6C4D1-9AC0-4562-B9AB-A926925356F9}\WpadDecision = "0"	Vqcttbn.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Sr.exe

pid process

1492 Sr.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

Sr.exeVqcttbn.exeVqcttbn.exe

pid process

1492 Sr.exe
520 Vqcttbn.exe
1124 Vqcttbn.exe

pid	process
1492	Sr.exe

pid	process
1492	Sr.exe
520	Vqcttbn.exe
1124	Vqcttbn.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Vqcttbn.exe

description	pid	process	target process
PID 520 wrote to memory of 1124	520	Vqcttbn.exe	Vqcttbn.exe
PID 520 wrote to memory of 1124	520	Vqcttbn.exe	Vqcttbn.exe
PID 520 wrote to memory of 1124	520	Vqcttbn.exe	Vqcttbn.exe
PID 520 wrote to memory of 1124	520	Vqcttbn.exe	Vqcttbn.exe

C:\Users\Admin\AppData\Local\Temp\Sr.exe
"C:\Users\Admin\AppData\Local\Temp\Sr.exe"
1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1492

C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe
"C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:520

C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe
"C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe" Win7
2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1124

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe
Filesize
1.0MB

MD5
6f4fc9a2f722fb24d5944c3720c8e086

SHA1
47b9064ae4db4974776bf8bd1bba8840b77124d2

SHA256
d7420275fec10fe9b857d9a7688e50e86534f0aab151c5e766fc74833f34e478

SHA512
6e3c4ebc7738115862e935b7cb18271969df1b2d54b49415d2500294b6391fb8f0dad0fe18bbeb69b865ecb40478ecad9c46e7b65c443e6445047164cf82f9e2

Download Submit
C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe
Filesize
1.0MB

MD5
6f4fc9a2f722fb24d5944c3720c8e086

SHA1
47b9064ae4db4974776bf8bd1bba8840b77124d2

SHA256
d7420275fec10fe9b857d9a7688e50e86534f0aab151c5e766fc74833f34e478

SHA512
6e3c4ebc7738115862e935b7cb18271969df1b2d54b49415d2500294b6391fb8f0dad0fe18bbeb69b865ecb40478ecad9c46e7b65c443e6445047164cf82f9e2

Download Submit
C:\Program Files (x86)\Microsoft Agacyc\Vqcttbn.exe
Filesize
1.0MB

MD5
6f4fc9a2f722fb24d5944c3720c8e086

SHA1
47b9064ae4db4974776bf8bd1bba8840b77124d2

SHA256
d7420275fec10fe9b857d9a7688e50e86534f0aab151c5e766fc74833f34e478

SHA512
6e3c4ebc7738115862e935b7cb18271969df1b2d54b49415d2500294b6391fb8f0dad0fe18bbeb69b865ecb40478ecad9c46e7b65c443e6445047164cf82f9e2

Download Submit
memory/1124-64-0x0000000000000000-mapping.dmp

Download
memory/1492-54-0x0000000076121000-0x0000000076123000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads