chinese_generic_botnet | 922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302

General

Target

922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe
Size

3.1MB
MD5

4d6175dd80a5696b672a54c60e88fc0d
SHA1

97ff12946f0701a7535ac58d35461bb429ab385c
SHA256

922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302
SHA512

43ec95734baa2382f4fc8ca21a919b23a3f95c715d797a22da921eb10b64af5a78b7b6618bea322969a81f1cdea27a71f94f256ea68d0fe8ea4e62ee74507b3a
SSDEEP

98304:2Z9KU4N0c8jAymp3HT1UO+YCezFLOAkGkzdnEVomFHKnPI:2ZbJO+YCezFLOyomFHKnPI

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

resource	yara_rule
behavioral2/memory/4968-133-0x0000000002930000-0x0000000002956000-memory.dmp	unk_chinese_botnet
behavioral2/memory/4968-134-0x0000000010000000-0x0000000010027000-memory.dmp	unk_chinese_botnet

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe

Executes dropped EXE 1 IoCs

pid	Process
4440	Windowsfig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2588	4440	WerFault.exe	89

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4440	Windowsfig.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4440	Windowsfig.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 4440	4968	922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe	89
PID 4968 wrote to memory of 4440	4968	922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe	89
PID 4968 wrote to memory of 4440	4968	922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe	89
PID 4968 wrote to memory of 1460	4968	922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe	90
PID 4968 wrote to memory of 1460	4968	922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe	90
PID 4968 wrote to memory of 1460	4968	922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe	90

C:\Users\Admin\AppData\Local\Temp\922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe
"C:\Users\Admin\AppData\Local\Temp\922b693de9579da71cb893c1ed0fb75bdbb6f6ce9684f6549d3f12b202704302.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4968
- C:\ProgramData\Windowsfig.exe
  "C:\ProgramData\Windowsfig.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4440
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4440 -s 2356
    3⤵
    - Program crash
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "del /F /S /Q /A C:\ProgramData\Windowsfig.exe"
  2⤵
  PID:1460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4440 -ip 4440
1⤵
PID:4868

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mpns1sl1.mmf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/4440-176-0x0000000009AF0000-0x0000000009B86000-memory.dmp

Filesize
600KB

Download
memory/4440-178-0x0000000009B90000-0x0000000009BF6000-memory.dmp

Filesize
408KB

Download
memory/4440-162-0x0000000009420000-0x0000000009A48000-memory.dmp

Filesize
6.2MB

Download
memory/4440-163-0x0000000005730000-0x0000000005740000-memory.dmp

Filesize
64KB

Download
memory/4440-196-0x0000000005730000-0x0000000005740000-memory.dmp

Filesize
64KB

Download
memory/4440-173-0x00000000092F0000-0x000000000930A000-memory.dmp

Filesize
104KB

Download
memory/4440-174-0x0000000009350000-0x0000000009386000-memory.dmp

Filesize
216KB

Download
memory/4440-175-0x000000000A0D0000-0x000000000A74A000-memory.dmp

Filesize
6.5MB

Download
memory/4440-195-0x00000000FEE50000-0x00000000FEE60000-memory.dmp

Filesize
64KB

Download
memory/4440-161-0x0000000000E50000-0x0000000000E70000-memory.dmp

Filesize
128KB

Download
memory/4440-177-0x00000000093E0000-0x0000000009402000-memory.dmp

Filesize
136KB

Download
memory/4440-180-0x0000000009AB0000-0x0000000009ACE000-memory.dmp

Filesize
120KB

Download
memory/4440-181-0x0000000009C50000-0x0000000009C9A000-memory.dmp

Filesize
296KB

Download
memory/4440-179-0x000000000AD00000-0x000000000B2A4000-memory.dmp

Filesize
5.6MB

Download
memory/4440-182-0x000000000ABB0000-0x000000000AC16000-memory.dmp

Filesize
408KB

Download
memory/4440-183-0x000000000AC20000-0x000000000AC42000-memory.dmp

Filesize
136KB

Download
memory/4440-193-0x0000000007E10000-0x0000000007E2E000-memory.dmp

Filesize
120KB

Download
memory/4440-194-0x0000000008A00000-0x0000000008A0A000-memory.dmp

Filesize
40KB

Download
memory/4968-133-0x0000000002930000-0x0000000002956000-memory.dmp

Filesize
152KB

Download
memory/4968-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing