Overview

overview

10

Static

static

1

3651d9ca9d...07.exe

windows7-x64

10

3651d9ca9d...07.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    91s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2023 02:22

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3651d9ca9d9a43985750f0de73f0c807.exe

  • Size

    3.4MB

  • MD5

    3651d9ca9d9a43985750f0de73f0c807

  • SHA1

    15810e62673e4625b4c8c61ad37f4b48a4760f55

  • SHA256

    8e4856e97753bf0e0c73b10d7d7891968e347b73dd2b506e6308d7bca7af0dd0

  • SHA512

    23f604c116eea0d4212740594eefe0b044d6e088fad17bbc073c97923e31cb28b53a570a375adf012dbb7f797827595e48bf9a781913f4c08ae0125e0d0a5e05

  • SSDEEP

    98304:Ps+xhKoQJBwKhJ+O+uiXAqSuuWHoFN6WtljaEy9oFLOAkGkzdnEVomFHKnP:5oJpQAqSudHmN6WtljaEyqFLOyomFHKP

Score
10/10
chinese_generic_botnetbotnet

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Chinese Botnet payload 1 IoCs
    botnet
  • Program crash 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3651d9ca9d9a43985750f0de73f0c807.exe
    "C:\Users\Admin\AppData\Local\Temp\3651d9ca9d9a43985750f0de73f0c807.exe"
    1⤵
      PID:2132
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2132 -s 600
        2⤵
        • Program crash
        PID:4260
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 368 -p 2132 -ip 2132
      1⤵
        PID:2360

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/2132-133-0x00000000014B0000-0x00000000014D5000-memory.dmp

        Filesize

        148KB

        Download