Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-08-2023 11:17

General

  • Target

    70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe

  • Size

    5.8MB

  • MD5

    4d42664fdb69d9388ae4a0ccfe467caf

  • SHA1

    ed3c203080c2021adcc08c909256bf69eefa3e79

  • SHA256

    70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284

  • SHA512

    ba5250ec56d937200546ae5c8c4e71d7208e2f1046b87a2bd81eb38d29dc4960b4ea87342c0c2c150ef754a7e4ba6ef921ae374c5ea360f5966fe567b1689947

  • SSDEEP

    98304:AqVQ4tml/iUm4XHb8vFtYkQhrSz9rAmLJHORm6UJamI3LeojzZARZpkAdcc6IjWF:/J+jX7oD+rSpru+W3KMZkvdagNXhJs0I

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Chinese Botnet payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe
    "C:\Users\Admin\AppData\Local\Temp\70cd8c7a8bcb2f32d165d3797764c0ad5f8cf84f7a55d231203ceeabb957f284.exe"
    1⤵
    • Drops file in Windows directory
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1108
    • C:\Windows\GameLoadep.exe
      C:\Windows\GameLoadep.exe
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      PID:2572

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\GameLoadep.exe

    Filesize

    864KB

    MD5

    645a7e5dc4adc68141447b01cb9cec49

    SHA1

    2f83beeb3031aa238c8eba4ae04398ff38274780

    SHA256

    76931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17

    SHA512

    fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de

  • C:\Windows\GameLoadep.exe

    Filesize

    864KB

    MD5

    645a7e5dc4adc68141447b01cb9cec49

    SHA1

    2f83beeb3031aa238c8eba4ae04398ff38274780

    SHA256

    76931bce0663f68f95a46414d389042181c690749eed44cb09aae325a0b9ef17

    SHA512

    fdf56fcacc1b43c94bd2811ad3926706f7382fc1d3e20c58b050cf254019c3b6226d0ffa8d4ba6aec259d3a99cb63d06d02156dd6dabab59b91418ba462885de

  • memory/1108-4064-0x0000000001060000-0x0000000001061000-memory.dmp

    Filesize

    4KB

  • memory/1108-135-0x0000000001060000-0x0000000001061000-memory.dmp

    Filesize

    4KB

  • memory/1108-134-0x0000000001060000-0x0000000001061000-memory.dmp

    Filesize

    4KB

  • memory/1108-4065-0x0000000001060000-0x0000000001061000-memory.dmp

    Filesize

    4KB

  • memory/2572-139-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/2572-4015-0x0000000075940000-0x0000000075AE0000-memory.dmp

    Filesize

    1.6MB

  • memory/2572-141-0x0000000076080000-0x0000000076295000-memory.dmp

    Filesize

    2.1MB

  • memory/2572-6026-0x00000000756F0000-0x000000007576A000-memory.dmp

    Filesize

    488KB

  • memory/2572-13211-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/2572-13212-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/2572-13214-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/2572-13215-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB

  • memory/2572-13216-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB

  • memory/2572-13219-0x0000000000400000-0x000000000051F000-memory.dmp

    Filesize

    1.1MB