Overview

overview

10

Static

static

1

tmp.exe

windows7-x64

10

tmp.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp

  • Size

    866KB

  • Sample

    230221-wxfw8shg7t

  • MD5

    7b1f03fb9936f72548c7d006eabfc310

  • SHA1

    66aef8129896c6e6dd36b2e3abadbbce7b4d51d6

  • SHA256

    e12d85aa606d45cdbb85982f5ea17d5c0b6f030dbbb30275ec0803f37c188a5b

  • SHA512

    f20b8348e0eb82f61fbaa98ce771f260bbbd22e1cf6018a49338d457b0ab5213a853e81cb4e4760c2c167a04279c6772a5076849dc89120fe31e05bb21f8c403

  • SSDEEP

    24576:b2c2oVEmdgUwB4qM742kyxzDL/KHYAmCS:ac2osByEby5DL/Dr

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      tmp

    • Size

      866KB

    • MD5

      7b1f03fb9936f72548c7d006eabfc310

    • SHA1

      66aef8129896c6e6dd36b2e3abadbbce7b4d51d6

    • SHA256

      e12d85aa606d45cdbb85982f5ea17d5c0b6f030dbbb30275ec0803f37c188a5b

    • SHA512

      f20b8348e0eb82f61fbaa98ce771f260bbbd22e1cf6018a49338d457b0ab5213a853e81cb4e4760c2c167a04279c6772a5076849dc89120fe31e05bb21f8c403

    • SSDEEP

      24576:b2c2oVEmdgUwB4qM742kyxzDL/KHYAmCS:ac2osByEby5DL/Dr

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks