chinese_generic_botnet | c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d

General

Target

c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
Size

1.1MB
MD5

07b3f0a6e96cdaf151d93b498f80a657
SHA1

292f54a95a841f9320d79005e40a6eb06a407f84
SHA256

c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d
SHA512

c79d470ead238f2a211796645f545d123db4eb8ba9c3bdcb0e2c26cff4896553fe3432855fec5153da8e7e1ebb787754326dc1d8032617dc3cf4c4e674992364
SSDEEP

24576:7bW+w2dCjdOQvaT2r+rJAjjYjWx4i6dwPyAmDyuuN59FoOCqDW:7StgQvaSrrKWV6dwKAmDun9FdCH

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/5112-6677-0x0000000010000000-0x000000001001F000-memory.dmp	unk_chinese_botnet
behavioral2/memory/5112-6681-0x0000000000400000-0x000000000056B000-memory.dmp	unk_chinese_botnet

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

Processes:

c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe

pid	process
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
5112	c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe

pid process

5112 c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe

C:\Users\Admin\AppData\Local\Temp\c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe
"C:\Users\Admin\AppData\Local\Temp\c79629afcc688c5aacc77c3ac8936b1d541ad2516c1b4e492ffd5cb291e8be7d.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
PID:5112

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5112-133-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/5112-134-0x0000000076800000-0x0000000076A15000-memory.dmp

Filesize
2.1MB

Download
memory/5112-2072-0x0000000076F20000-0x00000000770C0000-memory.dmp

Filesize
1.6MB

Download
memory/5112-3077-0x0000000075B50000-0x0000000075BCA000-memory.dmp

Filesize
488KB

Download
memory/5112-6670-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/5112-6671-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/5112-6672-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/5112-6673-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/5112-6674-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/5112-6676-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download
memory/5112-6677-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download
memory/5112-6681-0x0000000000400000-0x000000000056B000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing