Overview

overview

10

Static

static

3

9159b1caff...b2.exe

windows7-x64

10

9159b1caff...b2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9159b1caffb60b67e3ca0e9d30b2dfb2.exe

  • Size

    352KB

  • Sample

    230519-hjpekafe82

  • MD5

    9159b1caffb60b67e3ca0e9d30b2dfb2

  • SHA1

    ae4449ae8f24d2de121bbb3939fc5d4d43ed1e4c

  • SHA256

    2ca7ee8a683a5506547320b23f4ba37ff6f91a907c9c9e06c5b68376d3711d4f

  • SHA512

    894548e92608a85f211f604beebfd0c0269c2eabc1950f6b9ea84fe4f3f68412e248b10c56690a09ffe2d968c208160927ca82a9dbf8b9d12b75d6a7fc932afb

  • SSDEEP

    3072:fAAdrtCSXB538PKKQplrPxqlXsPygMPG1C68x7E:VUPKKWlbo0MPKC68x

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Targets

    • Target

      9159b1caffb60b67e3ca0e9d30b2dfb2.exe

    • Size

      352KB

    • MD5

      9159b1caffb60b67e3ca0e9d30b2dfb2

    • SHA1

      ae4449ae8f24d2de121bbb3939fc5d4d43ed1e4c

    • SHA256

      2ca7ee8a683a5506547320b23f4ba37ff6f91a907c9c9e06c5b68376d3711d4f

    • SHA512

      894548e92608a85f211f604beebfd0c0269c2eabc1950f6b9ea84fe4f3f68412e248b10c56690a09ffe2d968c208160927ca82a9dbf8b9d12b75d6a7fc932afb

    • SSDEEP

      3072:fAAdrtCSXB538PKKQplrPxqlXsPygMPG1C68x7E:VUPKKWlbo0MPKC68x

    Score
    10/10
    chinese_generic_botnetbotnetpersistence

    • Generic Chinese Botnet

      A botnet originating from China which is currently unnamed publicly.

      botnetchinese_generic_botnet

    • Chinese Botnet payload

      botnet

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks