chinese_generic_botnet | d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-01-2023 21:24

Target

d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe
Size

664KB
MD5

2a37383146e54ca009b9698877f2970f
SHA1

6a7971f9623d3ad82caaea4c028face84f490058
SHA256

d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754
SHA512

a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef
SSDEEP

3072:upH0jrEzxbJpF+ax8oSZylh76xFwZvMZYgUamncbwTrnRNXiY39+Zsz8CIa9OWYI:+zFJKYjh+xFwLbRNXiYt+Wz8za

Score

10^/10

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/1756-56-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

Processes:

Kqakiwq.exeKqakiwq.exe

pid process

1068 Kqakiwq.exe
1852 Kqakiwq.exe

pid	process
1068	Kqakiwq.exe
1852	Kqakiwq.exe

Drops file in Program Files directory 2 IoCs

Processes:

d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe	d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe
File opened for modification	C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe	d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe

pid process

1756 d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exeKqakiwq.exeKqakiwq.exe

pid process

1756 d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe
1068 Kqakiwq.exe
1852 Kqakiwq.exe

pid	process
1756	d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Kqakiwq.exe

description	pid	process	target process
PID 1068 wrote to memory of 1852	1068	Kqakiwq.exe	Kqakiwq.exe
PID 1068 wrote to memory of 1852	1068	Kqakiwq.exe	Kqakiwq.exe
PID 1068 wrote to memory of 1852	1068	Kqakiwq.exe	Kqakiwq.exe
PID 1068 wrote to memory of 1852	1068	Kqakiwq.exe	Kqakiwq.exe

C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe
Filesize
664KB

MD5
2a37383146e54ca009b9698877f2970f

SHA1
6a7971f9623d3ad82caaea4c028face84f490058

SHA256
d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754

SHA512
a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef

Download Submit
C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe
Filesize
664KB

MD5
2a37383146e54ca009b9698877f2970f

SHA1
6a7971f9623d3ad82caaea4c028face84f490058

SHA256
d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754

SHA512
a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef

Download Submit
C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe
Filesize
664KB

MD5
2a37383146e54ca009b9698877f2970f

SHA1
6a7971f9623d3ad82caaea4c028face84f490058

SHA256
d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754

SHA512
a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef

Download Submit
memory/1756-54-0x0000000076411000-0x0000000076413000-memory.dmp

Filesize
8KB

Download
memory/1756-55-0x0000000000400000-0x00000000004A9000-memory.dmp

Filesize
676KB

Download
memory/1756-56-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1852-66-0x0000000000000000-mapping.dmp

Download