chinese_generic_botnet | b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007

General

Target

b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
Size

3.3MB
MD5

8743c3ae51102822d1b9f23a9340a22b
SHA1

6ab86675bffdfa441706f72406cfaa67c8b2fb53
SHA256

b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007
SHA512

084401541a0e754b4fc25c31a4eb005dcb5aee4a85c5c2e33f3c74ba54b6f865380585309ba4765c58a811879f66eb4bdd9eb8013f7ec17735979c16e9c5c888
SSDEEP

98304:neO0TPRHtdCuUyxIkzKw1kdVlOZFLOAkGkzdnEVomFHKnPr:nCRTgw1kdViFLOyomFHKnPr

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

resource	yara_rule
behavioral2/memory/524-133-0x0000000002800000-0x0000000002826000-memory.dmp	unk_chinese_botnet
behavioral2/memory/524-134-0x0000000010000000-0x0000000010027000-memory.dmp	unk_chinese_botnet

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1675742406-747946869-1029867430-1000\Control Panel\International\Geo\Nation	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe

Executes dropped EXE 1 IoCs

pid	Process
3512	Windowsfig.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\G:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\K:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\Z:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\V:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\W:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\X:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\I:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\L:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\N:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\Q:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\R:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\Y:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\F:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\M:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\T:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\U:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\S:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\E:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\H:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\J:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\O:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
File opened (read-only)	\??\P:	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4724	3512	WerFault.exe	91

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3512	Windowsfig.exe
524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3512	Windowsfig.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 524 wrote to memory of 3512	524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe	91
PID 524 wrote to memory of 3512	524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe	91
PID 524 wrote to memory of 3512	524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe	91
PID 524 wrote to memory of 408	524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe	92
PID 524 wrote to memory of 408	524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe	92
PID 524 wrote to memory of 408	524	b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe	92

C:\Users\Admin\AppData\Local\Temp\b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe
"C:\Users\Admin\AppData\Local\Temp\b3159f8e9974da73ea503de350277b19007c1f47fd1e5635d2641efd25bc9007.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:524
- C:\ProgramData\Windowsfig.exe
  "C:\ProgramData\Windowsfig.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3512
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3512 -s 2200
    3⤵
    - Program crash
    PID:4724
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "del /F /S /Q /A C:\ProgramData\Windowsfig.exe"
  2⤵
  PID:408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 3512 -ip 3512
1⤵
PID:3544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lxc1w1dg.0er.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/524-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/524-133-0x0000000002800000-0x0000000002826000-memory.dmp

Filesize
152KB

Download
memory/3512-175-0x0000000006870000-0x00000000068A6000-memory.dmp

Filesize
216KB

Download
memory/3512-180-0x0000000007D80000-0x0000000008324000-memory.dmp

Filesize
5.6MB

Download
memory/3512-163-0x0000000008E30000-0x0000000009458000-memory.dmp

Filesize
6.2MB

Download
memory/3512-174-0x0000000006810000-0x000000000682A000-memory.dmp

Filesize
104KB

Download
memory/3512-162-0x00000000008F0000-0x0000000000910000-memory.dmp

Filesize
128KB

Download
memory/3512-176-0x0000000007700000-0x0000000007D7A000-memory.dmp

Filesize
6.5MB

Download
memory/3512-177-0x0000000006950000-0x00000000069E6000-memory.dmp

Filesize
600KB

Download
memory/3512-178-0x00000000068F0000-0x0000000006912000-memory.dmp

Filesize
136KB

Download
memory/3512-179-0x0000000006A60000-0x0000000006AC6000-memory.dmp

Filesize
408KB

Download
memory/3512-164-0x0000000005270000-0x0000000005280000-memory.dmp

Filesize
64KB

Download
memory/3512-181-0x0000000006A30000-0x0000000006A4E000-memory.dmp

Filesize
120KB

Download
memory/3512-182-0x0000000006B20000-0x0000000006B6A000-memory.dmp

Filesize
296KB

Download
memory/3512-183-0x00000000073F0000-0x0000000007456000-memory.dmp

Filesize
408KB

Download
memory/3512-184-0x0000000008350000-0x0000000008372000-memory.dmp

Filesize
136KB

Download
memory/3512-194-0x00000000056E0000-0x00000000056FE000-memory.dmp

Filesize
120KB

Download
memory/3512-195-0x00000000062D0000-0x00000000062DA000-memory.dmp

Filesize
40KB

Download
memory/3512-196-0x00000000FFBD0000-0x00000000FFBE0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads