Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
10-08-2023 11:17
Static task
static1
Behavioral task
behavioral1
Sample
70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe
Resource
win10v2004-20230703-en
General
-
Target
70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe
-
Size
5.8MB
-
MD5
4d42664fdb69d9388ae4a0ccfe467caf
-
SHA1
ed3c203080c2021adcc08c909256bf69eefa3e79
-
SHA256
70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284
-
SHA512
ba5250ec56d937200546ae5c8c4e71d7208e2f1046b87a2bd81eb38d29dc4960b4ea87342c0c2c150ef754a7e4ba6ef921ae374c5ea360f5966fe567b1689947
-
SSDEEP
98304:AqVQ4tml/iUm4XHb8vFtYkQhrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:/J+jX7oD+rSpru+W3KMZkvdagNXhJs0I
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
resource yara_rule behavioral2/memory/2572-13216-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet behavioral2/memory/2572-13219-0x0000000000400000-0x000000000051F000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 1 IoCs
pid Process 2572 GameLoadep.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Terms.exe = "C:\\Windows\\GameLoadep.exe" GameLoadep.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
pid Process 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe 2572 GameLoadep.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\GameLoadep.exe 70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2572 GameLoadep.exe 2572 GameLoadep.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 1108 70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1108 70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe 1108 70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1108 wrote to memory of 2572 1108 70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe 84 PID 1108 wrote to memory of 2572 1108 70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe 84 PID 1108 wrote to memory of 2572 1108 70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe"C:\Users\Admin\AppData\Local\Temp\70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\GameLoadep.exeC:\Windows\GameLoadep.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2572
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
864KB
MD5645a7e5dc4adc68141447b01cb9cec49
SHA12f83beeb3031aa238c8eba4ae04398ff38274780
SHA25676931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17
SHA512fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de
-
Filesize
864KB
MD5645a7e5dc4adc68141447b01cb9cec49
SHA12f83beeb3031aa238c8eba4ae04398ff38274780
SHA25676931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17
SHA512fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de