Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
-
submitted
29-01-2023 21:24
General
-
Target
d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe
-
Size
664KB
-
MD5
2a37383146e54ca009b9698877f2970f
-
SHA1
6a7971f9623d3ad82caaea4c028face84f490058
-
SHA256
d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754
-
SHA512
a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef
-
SSDEEP
3072:upH0jrEzxbJpF+ax8oSZylh76xFwZvMZYgUamncbwTrnRNXiY39+Zsz8CIa9OWYI:+zFJKYjh+xFwLbRNXiYt+Wz8za
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe"C:\Users\Admin\AppData\Local\Temp\d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe"C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe"C:\Program Files (x86)\Microsoft Nrxwyt\Kqakiwq.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
664KB
MD52a37383146e54ca009b9698877f2970f
SHA16a7971f9623d3ad82caaea4c028face84f490058
SHA256d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754
SHA512a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef
-
Filesize
664KB
MD52a37383146e54ca009b9698877f2970f
SHA16a7971f9623d3ad82caaea4c028face84f490058
SHA256d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754
SHA512a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef
-
Filesize
664KB
MD52a37383146e54ca009b9698877f2970f
SHA16a7971f9623d3ad82caaea4c028face84f490058
SHA256d73a82234b769285027a00e8e6012c3950f343f3c64c237f80deac7776725754
SHA512a04f880997d83d057e9181810091b625b9c7b0a216e9d5770a08f2e86b70f2b16e9bd777ca5741c37e4465c772a6174cc4524885616d28a0ee8f6fa351d3dbef
-
Filesize
8KB
-
Filesize
676KB
-
Filesize
96KB