chinese_generic_botnet | e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0

General

Target

e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
Size

3.4MB
MD5

58b916ae442df6c81744ddae2221cabe
SHA1

cf5be2bd01717f8141e517546a32b484d8bc7f9e
SHA256

e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0
SHA512

da626a4736fc962004652ddfcee740b53049961058b53cee84f88b901e2243408dbfdad9dffc86e0d9312927122e930ebf37888d4d1e4abee1d0cfe123be2db2
SSDEEP

98304:93dyYV/1g8pxdfR/mKYvuxNhthE1GR0FLOAkGkzdnEVomFHKnPA:hd/gsdflzdNhE1GR0FLOyomFHKnP

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

resource	yara_rule
behavioral2/memory/1716-133-0x0000000002BF0000-0x0000000002C16000-memory.dmp	unk_chinese_botnet
behavioral2/memory/1716-134-0x0000000010000000-0x0000000010027000-memory.dmp	unk_chinese_botnet

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000\Control Panel\International\Geo\Nation	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe

Executes dropped EXE 1 IoCs

pid	Process
4104	Windowsfig.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\M:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\H:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\Q:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\S:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\U:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\W:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\Z:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\E:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\G:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\L:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\T:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\V:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\X:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\Y:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\F:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\I:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\K:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\N:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\O:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\P:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\R:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\B:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
File opened (read-only)	\??\J:	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1436	4104	WerFault.exe	90

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4104	Windowsfig.exe
1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	Windowsfig.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 4104	1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe	90
PID 1716 wrote to memory of 4104	1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe	90
PID 1716 wrote to memory of 4104	1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe	90
PID 1716 wrote to memory of 1420	1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe	91
PID 1716 wrote to memory of 1420	1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe	91
PID 1716 wrote to memory of 1420	1716	e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe	91

C:\Users\Admin\AppData\Local\Temp\e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe
"C:\Users\Admin\AppData\Local\Temp\e9a420ebce08d2c90e6b536969171438363f2140d99f1c9f3d91f00cb292a6a0.exe"
1⤵
- Checks computer location settings
- Enumerates connected drives
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1716
- C:\ProgramData\Windowsfig.exe
  "C:\ProgramData\Windowsfig.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4104
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4104 -s 2392
    3⤵
    - Program crash
    PID:1436
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "del /F /S /Q /A C:\ProgramData\Windowsfig.exe"
  2⤵
  PID:1420

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 208 -p 4104 -ip 4104
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\ProgramData\Windowsfig.exe

Filesize
108KB

MD5
40528a8ce542af784cb9958552f7798d

SHA1
58c5ba782f367a1d65bf712ada150fe0b5e14292

SHA256
46780be1f3276ff325e105b85d5cac13b1eae75b04d17340bca01c7d63027cfc

SHA512
dad82f72882e2a7ca2fe4cea7360150bdffe394dca582f7afdc378ff6e77578e3dd12da668bf2297532b3d2475d97838571cca6343c4a7515d26449acf287e0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_m5e31nu1.ob0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1716-134-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download
memory/1716-133-0x0000000002BF0000-0x0000000002C16000-memory.dmp

Filesize
152KB

Download
memory/4104-175-0x0000000006AC0000-0x0000000006AF6000-memory.dmp

Filesize
216KB

Download
memory/4104-180-0x0000000008030000-0x00000000085D4000-memory.dmp

Filesize
5.6MB

Download
memory/4104-163-0x00000000090E0000-0x0000000009708000-memory.dmp

Filesize
6.2MB

Download
memory/4104-174-0x0000000006A60000-0x0000000006A7A000-memory.dmp

Filesize
104KB

Download
memory/4104-162-0x0000000000B40000-0x0000000000B60000-memory.dmp

Filesize
128KB

Download
memory/4104-176-0x00000000079B0000-0x000000000802A000-memory.dmp

Filesize
6.5MB

Download
memory/4104-177-0x0000000006BA0000-0x0000000006C36000-memory.dmp

Filesize
600KB

Download
memory/4104-178-0x0000000006B40000-0x0000000006B62000-memory.dmp

Filesize
136KB

Download
memory/4104-179-0x0000000006CB0000-0x0000000006D16000-memory.dmp

Filesize
408KB

Download
memory/4104-164-0x0000000005750000-0x0000000005760000-memory.dmp

Filesize
64KB

Download
memory/4104-181-0x0000000006C80000-0x0000000006C9E000-memory.dmp

Filesize
120KB

Download
memory/4104-182-0x0000000006D70000-0x0000000006DBA000-memory.dmp

Filesize
296KB

Download
memory/4104-183-0x0000000007640000-0x00000000076A6000-memory.dmp

Filesize
408KB

Download
memory/4104-184-0x00000000076E0000-0x0000000007702000-memory.dmp

Filesize
136KB

Download
memory/4104-194-0x0000000005AC0000-0x0000000005ADE000-memory.dmp

Filesize
120KB

Download
memory/4104-195-0x0000000005F70000-0x0000000005F7A000-memory.dmp

Filesize
40KB

Download
memory/4104-196-0x00000000FEE80000-0x00000000FEE90000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads