Analysis
-
max time kernel
150s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
28-08-2023 00:57
General
-
Target
0e3d8dca5987deef0c19850cec15f98e00b27d8bf5e4df7be75f51129a6fd86b.exe
-
Size
3.3MB
-
MD5
fddedd7cb5fb16effca4196dc99e1b22
-
SHA1
13d9c9bb6824bc2677a01f5568d386f490c51c0f
-
SHA256
0e3d8dca5987deef0c19850cec15f98e00b27d8bf5e4df7be75f51129a6fd86b
-
SHA512
28d34ff0ff49b9c452d2478b38251d5d37ff104cde04d02a71d5c366809240797aeface72568a1c7fe97920a9fa2f6550928ce05f08fc7dd0dbf1d378f019c18
-
SSDEEP
49152:t/ZqDrioxi03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCz:t/ZYT0uDhEv4n4M
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e3d8dca5987deef0c19850cec15f98e00b27d8bf5e4df7be75f51129a6fd86b.exe"C:\Users\Admin\AppData\Local\Temp\0e3d8dca5987deef0c19850cec15f98e00b27d8bf5e4df7be75f51129a6fd86b.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\QProtect.exe"C:\Program Files (x86)\QProtect.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\QProtect.exe"C:\Program Files (x86)\QProtect.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.3MB
MD5fddedd7cb5fb16effca4196dc99e1b22
SHA113d9c9bb6824bc2677a01f5568d386f490c51c0f
SHA2560e3d8dca5987deef0c19850cec15f98e00b27d8bf5e4df7be75f51129a6fd86b
SHA51228d34ff0ff49b9c452d2478b38251d5d37ff104cde04d02a71d5c366809240797aeface72568a1c7fe97920a9fa2f6550928ce05f08fc7dd0dbf1d378f019c18
-
Filesize
3.3MB
MD5fddedd7cb5fb16effca4196dc99e1b22
SHA113d9c9bb6824bc2677a01f5568d386f490c51c0f
SHA2560e3d8dca5987deef0c19850cec15f98e00b27d8bf5e4df7be75f51129a6fd86b
SHA51228d34ff0ff49b9c452d2478b38251d5d37ff104cde04d02a71d5c366809240797aeface72568a1c7fe97920a9fa2f6550928ce05f08fc7dd0dbf1d378f019c18
-
Filesize
3.3MB
MD5fddedd7cb5fb16effca4196dc99e1b22
SHA113d9c9bb6824bc2677a01f5568d386f490c51c0f
SHA2560e3d8dca5987deef0c19850cec15f98e00b27d8bf5e4df7be75f51129a6fd86b
SHA51228d34ff0ff49b9c452d2478b38251d5d37ff104cde04d02a71d5c366809240797aeface72568a1c7fe97920a9fa2f6550928ce05f08fc7dd0dbf1d378f019c18
-
Filesize
124KB