chinese_generic_botnet | c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
24-05-2023 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
Size

1.1MB
MD5

07b3f0a6e96cdaf151d93b498f80a657
SHA1

292f54a95a841f9320d79005e40a6eb06a407f84
SHA256

c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d
SHA512

c79d470ead238f2a211796645f545d123db4eb8ba9c3bdcb0e2c26cff4896553fe3432855fec5153da8e7e1ebb787754326dc1d8032617dc3cf4c4e674992364
SSDEEP

24576:7bW+w2dCjdOQvaT2r+rJAjjYjWx4i6dwPyAmDyuuN59FoOCqDW:7StgQvaSrrKWV6dwKAmDun9FdCH

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/1752-4827-0x0000000000400000-0x000000000056B000-memory.dmp	unk_chinese_botnet

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1752	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe

C:\Users\Admin\AppData\Local\Temp\c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
"C:\Users\Admin\AppData\Local\Temp\c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:1752

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1752-54-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/1752-55-0x0000000075420000-0x0000000075467000-memory.dmp

Filesize
284KB

Download
memory/1752-462-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-461-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-464-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-465-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-463-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-468-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-469-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-467-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-466-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-472-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-473-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-471-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-470-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-474-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-475-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-476-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-480-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-481-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-479-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-478-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-477-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-482-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-483-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-484-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-485-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-489-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-490-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-488-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-487-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-486-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-494-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-495-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-493-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-492-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-491-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-499-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-500-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-498-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-497-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-496-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-504-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-505-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-503-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-502-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-501-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-509-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-510-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-508-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-507-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-506-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-515-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-516-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-514-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-513-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-512-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-511-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-518-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-517-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-520-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-521-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-519-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-523-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-522-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-1411-0x00000000007A0000-0x00000000008A0000-memory.dmp

Filesize
1024KB

Download
memory/1752-1413-0x0000000002040000-0x00000000021C1000-memory.dmp

Filesize
1.5MB

Download
memory/1752-4811-0x00000000022F0000-0x0000000002401000-memory.dmp

Filesize
1.1MB

Download
memory/1752-4816-0x00000000007A0000-0x00000000008A0000-memory.dmp

Filesize
1024KB

Download
memory/1752-4827-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads