Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17-04-2023 02:22
Static task
static1
Behavioral task
behavioral1
Sample
3651d9ca9d9a43985750f0de73f0c807.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3651d9ca9d9a43985750f0de73f0c807.exe
Resource
win10v2004-20230220-en
General
-
Target
3651d9ca9d9a43985750f0de73f0c807.exe
-
Size
3.4MB
-
MD5
3651d9ca9d9a43985750f0de73f0c807
-
SHA1
15810e62673e4625b4c8c61ad37f4b48a4760f55
-
SHA256
8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0
-
SHA512
23f604c116eea0d4212740594eefe0b044d6e088fad17bbc073c97923e31cb28b53a570a375adf012dbb7f797827595e48bf9a781913f4c08ae0125e0d0a5e05
-
SSDEEP
98304:Ps+xhKoQJBwKhJ+O+uiXAqSuuWHoFN6WtljaEy9oFLOAkGkzdnEVomFHKnP:5oJpQAqSudHmN6WtljaEyqFLOyomFHKP
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1604-54-0x0000000000140000-0x0000000000166000-memory.dmp unk_chinese_botnet behavioral1/memory/1604-55-0x0000000010000000-0x0000000010027000-memory.dmp unk_chinese_botnet -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
Windowsfig.exepid process 1780 Windowsfig.exe -
Loads dropped DLL 6 IoCs
Processes:
3651d9ca9d9a43985750f0de73f0c807.exeWerFault.exepid process 1604 3651d9ca9d9a43985750f0de73f0c807.exe 1080 WerFault.exe 1080 WerFault.exe 1080 WerFault.exe 1080 WerFault.exe 1080 WerFault.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1080 1780 WerFault.exe Windowsfig.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3651d9ca9d9a43985750f0de73f0c807.exeWindowsfig.exedescription pid process target process PID 1604 wrote to memory of 1780 1604 3651d9ca9d9a43985750f0de73f0c807.exe Windowsfig.exe PID 1604 wrote to memory of 1780 1604 3651d9ca9d9a43985750f0de73f0c807.exe Windowsfig.exe PID 1604 wrote to memory of 1780 1604 3651d9ca9d9a43985750f0de73f0c807.exe Windowsfig.exe PID 1604 wrote to memory of 1780 1604 3651d9ca9d9a43985750f0de73f0c807.exe Windowsfig.exe PID 1780 wrote to memory of 1080 1780 Windowsfig.exe WerFault.exe PID 1780 wrote to memory of 1080 1780 Windowsfig.exe WerFault.exe PID 1780 wrote to memory of 1080 1780 Windowsfig.exe WerFault.exe PID 1780 wrote to memory of 1080 1780 Windowsfig.exe WerFault.exe PID 1604 wrote to memory of 1084 1604 3651d9ca9d9a43985750f0de73f0c807.exe cmd.exe PID 1604 wrote to memory of 1084 1604 3651d9ca9d9a43985750f0de73f0c807.exe cmd.exe PID 1604 wrote to memory of 1084 1604 3651d9ca9d9a43985750f0de73f0c807.exe cmd.exe PID 1604 wrote to memory of 1084 1604 3651d9ca9d9a43985750f0de73f0c807.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3651d9ca9d9a43985750f0de73f0c807.exe"C:\Users\Admin\AppData\Local\Temp\3651d9ca9d9a43985750f0de73f0c807.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Windowsfig.exe"C:\ProgramData\Windowsfig.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 6243⤵
- Loads dropped DLL
- Program crash
-
C:\Windows\SysWOW64\cmd.execmd /C "del /F /S /Q /A C:\ProgramData\Windowsfig.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
C:\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
C:\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
\ProgramData\Windowsfig.exeFilesize
108KB
MD540528a8ce542af784cb9958552f7798d
SHA158c5ba782f367a1d65bf712ada150fe0b5e14292
SHA25646780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc
SHA512dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a
-
memory/1604-55-0x0000000010000000-0x0000000010027000-memory.dmpFilesize
156KB
-
memory/1604-54-0x0000000000140000-0x0000000000166000-memory.dmpFilesize
152KB
-
memory/1780-84-0x00000000003F0000-0x00000000003F6000-memory.dmpFilesize
24KB
-
memory/1780-83-0x00000000003A0000-0x00000000003BE000-memory.dmpFilesize
120KB
-
memory/1780-82-0x00000000003C0000-0x00000000003E0000-memory.dmpFilesize
128KB
-
memory/1780-90-0x0000000004A90000-0x0000000004AD0000-memory.dmpFilesize
256KB
-
memory/1780-91-0x0000000004A90000-0x0000000004AD0000-memory.dmpFilesize
256KB