chinese_generic_botnet | 17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452

General

Target

17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe
Size

3.1MB
MD5

9fa976d52ae40dc1f3b3b13dc6c76140
SHA1

3d1595588f5e16b65357f60795da96ab5249fbfb
SHA256

17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452
SHA512

384d04f1476e2e8d5a2ccfd0334afe80421f1a5303758240d00cc6d667e2de0362f6cbcd02fb276f012b28ea4af54ba14228f870269266c9a9d7c25cc488c7e0
SSDEEP

98304:O+QAqz6e1viI01SalmZhphU1JwYFLOAkGkzdnEVomFHKnP:O/5vRhphU1nFLOyomFHKnP

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

resource	yara_rule
behavioral2/memory/3760-146-0x0000000001150000-0x0000000001176000-memory.dmp	unk_chinese_botnet
behavioral2/memory/3760-148-0x0000000010000000-0x0000000010027000-memory.dmp	unk_chinese_botnet

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
3760	word.exe

Loads dropped DLL 1 IoCs

pid	Process
3760	word.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\word = "C:\\ProgramData\\e260\\word.exe"	word.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	word.exe
File opened (read-only)	\??\I:	word.exe
File opened (read-only)	\??\K:	word.exe
File opened (read-only)	\??\Q:	word.exe
File opened (read-only)	\??\V:	word.exe
File opened (read-only)	\??\B:	word.exe
File opened (read-only)	\??\L:	word.exe
File opened (read-only)	\??\U:	word.exe
File opened (read-only)	\??\X:	word.exe
File opened (read-only)	\??\Y:	word.exe
File opened (read-only)	\??\G:	word.exe
File opened (read-only)	\??\J:	word.exe
File opened (read-only)	\??\M:	word.exe
File opened (read-only)	\??\N:	word.exe
File opened (read-only)	\??\P:	word.exe
File opened (read-only)	\??\S:	word.exe
File opened (read-only)	\??\T:	word.exe
File opened (read-only)	\??\Z:	word.exe
File opened (read-only)	\??\H:	word.exe
File opened (read-only)	\??\O:	word.exe
File opened (read-only)	\??\R:	word.exe
File opened (read-only)	\??\W:	word.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1043950675-1972537973-2972532878-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3760	word.exe
3760	word.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 1108	1988	17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe	80
PID 1988 wrote to memory of 1108	1988	17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe	80
PID 1988 wrote to memory of 1108	1988	17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe	80
PID 1988 wrote to memory of 2316	1988	17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe	88
PID 1988 wrote to memory of 2316	1988	17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe	88
PID 1988 wrote to memory of 2316	1988	17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe	88

C:\Users\Admin\AppData\Local\Temp\17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe
"C:\Users\Admin\AppData\Local\Temp\17fc24f9a27d576de75bf22be948be15cc93d2906538f34ad114bc66ced60452.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\SysWOW64\cmd.exe
  cmd /C "md C:\ProgramData\e260"
  2⤵
  PID:1108
- C:\Windows\SysWOW64\cmd.exe
  cmd /c start C:\ProgramData\e260
  2⤵
  - Modifies registry class
  PID:2316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4484

C:\ProgramData\e260\word.exe
"C:\ProgramData\e260\word.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:3760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\e260\word.exe

Filesize
398KB

MD5
f13f5ac8b89c9ac8d02d1ef7cf9bdf0a

SHA1
a65ffcc750e84e3fdc6e56829ccd77229d73eee9

SHA256
1649152cf5eb988b0c02f413a29ec20fcd452e0c5aafd63406b1a7a9062c8a85

SHA512
0214670c60caaf1800704f6a93691f820a363b367a374584c6f56ea0497b1896db2d16c004315f16bfb65069ecbf53bf4b2f9ad34c6d8ba4b006c6482c9a5a40

Download Submit
C:\ProgramData\e260\word.exe

Filesize
398KB

MD5
f13f5ac8b89c9ac8d02d1ef7cf9bdf0a

SHA1
a65ffcc750e84e3fdc6e56829ccd77229d73eee9

SHA256
1649152cf5eb988b0c02f413a29ec20fcd452e0c5aafd63406b1a7a9062c8a85

SHA512
0214670c60caaf1800704f6a93691f820a363b367a374584c6f56ea0497b1896db2d16c004315f16bfb65069ecbf53bf4b2f9ad34c6d8ba4b006c6482c9a5a40

Download Submit
C:\ProgramData\e260\wwlib.dll

Filesize
105KB

MD5
8a716251a6ab1432e5ab4d6b206fb7aa

SHA1
c71df9277dc5a31146812f0f785e6d36ebeb2ed3

SHA256
d9b22ed4b440a83c858b8d741d1aa2cf7576f1887359fca163266917bdecd3bc

SHA512
dc8d5c62d202aa836f473535a1d4be6ac5098a8d81307c9c50c8028d693175aeeebfd028b3efcc5d80278023f945434395469812e0d89421d27abc58887b71f3

Download Submit
C:\ProgramData\e260\wwlib.dll

Filesize
105KB

MD5
8a716251a6ab1432e5ab4d6b206fb7aa

SHA1
c71df9277dc5a31146812f0f785e6d36ebeb2ed3

SHA256
d9b22ed4b440a83c858b8d741d1aa2cf7576f1887359fca163266917bdecd3bc

SHA512
dc8d5c62d202aa836f473535a1d4be6ac5098a8d81307c9c50c8028d693175aeeebfd028b3efcc5d80278023f945434395469812e0d89421d27abc58887b71f3

Download Submit
memory/3760-145-0x000000002FF20000-0x000000002FF86000-memory.dmp

Filesize
408KB

Download
memory/3760-146-0x0000000001150000-0x0000000001176000-memory.dmp

Filesize
152KB

Download
memory/3760-147-0x000000002FF20000-0x000000002FF86000-memory.dmp

Filesize
408KB

Download
memory/3760-148-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads