chinese_generic_botnet | 8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0

General

Target

8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe
Size

3.4MB
MD5

3651d9ca9d9a43985750f0de73f0c807
SHA1

15810e62673e4625b4c8c61ad37f4b48a4760f55
SHA256

8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0
SHA512

23f604c116eea0d4212740594eefe0b044d6e088fad17bbc073c97923e31cb28b53a570a375adf012dbb7f797827595e48bf9a781913f4c08ae0125e0d0a5e05
SSDEEP

98304:Ps+xhKoQJBwKhJ+O+uiXAqSuuWHoFN6WtljaEy9oFLOAkGkzdnEVomFHKnP:5oJpQAqSudHmN6WtljaEyqFLOyomFHKP

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

resource	yara_rule
behavioral2/memory/4188-133-0x0000000002A70000-0x0000000002A96000-memory.dmp	unk_chinese_botnet
behavioral2/memory/4188-134-0x0000000010000000-0x0000000010027000-memory.dmp	unk_chinese_botnet

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Control Panel\International\Geo\Nation	8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe

Executes dropped EXE 1 IoCs

pid	Process
448	Windowsfig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4524	448	WerFault.exe	92

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
448	Windowsfig.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	448	Windowsfig.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 448	4188	8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe	92
PID 4188 wrote to memory of 448	4188	8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe	92
PID 4188 wrote to memory of 448	4188	8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe	92
PID 4188 wrote to memory of 2092	4188	8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe	93
PID 4188 wrote to memory of 2092	4188	8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe	93
PID 4188 wrote to memory of 2092	4188	8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe	93

C:\Users\Admin\AppData\Local\Temp\8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe
"C:\Users\Admin\AppData\Local\Temp\8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4188
- C:\ProgramData\Windowsfig.exe
  "C:\ProgramData\Windowsfig.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:448
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 2200
    3⤵
    - Program crash
    PID:4524
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "del /F /S /Q /A C:\ProgramData\Windowsfig.exe"
  2⤵
  PID:2092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 448 -ip 448
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_irdphcfg.3cr.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/448-174-0x0000000008F30000-0x0000000008F66000-memory.dmp

Filesize
216KB

Download
memory/448-177-0x0000000008FB0000-0x0000000008FD2000-memory.dmp

Filesize
136KB

Download
memory/448-162-0x00000000090A0000-0x00000000096C8000-memory.dmp

Filesize
6.2MB

Download
memory/448-163-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/448-195-0x0000000008780000-0x000000000878A000-memory.dmp

Filesize
40KB

Download
memory/448-173-0x0000000008ED0000-0x0000000008EEA000-memory.dmp

Filesize
104KB

Download
memory/448-194-0x00000000FFA10000-0x00000000FFA20000-memory.dmp

Filesize
64KB

Download
memory/448-175-0x0000000009D50000-0x000000000A3CA000-memory.dmp

Filesize
6.5MB

Download
memory/448-176-0x00000000096D0000-0x0000000009766000-memory.dmp

Filesize
600KB

Download
memory/448-161-0x0000000000B60000-0x0000000000B80000-memory.dmp

Filesize
128KB

Download
memory/448-178-0x0000000009770000-0x00000000097D6000-memory.dmp

Filesize
408KB

Download
memory/448-179-0x000000000A980000-0x000000000AF24000-memory.dmp

Filesize
5.6MB

Download
memory/448-180-0x0000000009040000-0x000000000905E000-memory.dmp

Filesize
120KB

Download
memory/448-181-0x0000000009830000-0x000000000987A000-memory.dmp

Filesize
296KB

Download
memory/448-182-0x000000000A7A0000-0x000000000A806000-memory.dmp

Filesize
408KB

Download
memory/448-183-0x000000000A770000-0x000000000A792000-memory.dmp

Filesize
136KB

Download
memory/448-193-0x0000000007B90000-0x0000000007BAE000-memory.dmp

Filesize
120KB

Download
memory/4188-133-0x0000000002A70000-0x0000000002A96000-memory.dmp

Filesize
152KB

Download
memory/4188-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing