chinese_generic_botnet | 36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c

General

Target

36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe
Size

362KB
MD5

cd804b50743313fef57970afe59ee4cb
SHA1

236559269a5e0b2b89f00f37adafc726e561e152
SHA256

36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c
SHA512

aeca795b8a890ed215126e61a44bfb5c6c9ac2d299a141312e455d2b133abac510f08088c7746db7aee41cbfb9447942691ac9fe2d6af5a253d0a3730e68500e
SSDEEP

3072:N8jSZi34eTzl5FeuimwWzPhrW/A3t7qMv:quZ5eVzPowtmM

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/1448-0-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 1 IoCs

pid	Process
2752	Kycwuqk.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Kycwuqk.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Wvsrpg\Kycwuqk.exe	36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe
File opened for modification	C:\Program Files (x86)\Microsoft Wvsrpg\Kycwuqk.exe	36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Kycwuqk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Kycwuqk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Kycwuqk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Kycwuqk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F301953D-2CF5-4466-A463-4ABA4CEAA7EE}\WpadDecision = "0"	Kycwuqk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-26-f2-90-68-27\WpadDecisionReason = "1"	Kycwuqk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-26-f2-90-68-27\WpadDecisionTime = 506764d2acd9d901	Kycwuqk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Kycwuqk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F301953D-2CF5-4466-A463-4ABA4CEAA7EE}\WpadDecisionReason = "1"	Kycwuqk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F301953D-2CF5-4466-A463-4ABA4CEAA7EE}\WpadNetworkName = "Network 2"	Kycwuqk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F301953D-2CF5-4466-A463-4ABA4CEAA7EE}\WpadDecisionTime = 506764d2acd9d901	Kycwuqk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Kycwuqk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Kycwuqk.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Kycwuqk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Kycwuqk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kycwuqk.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Kycwuqk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F301953D-2CF5-4466-A463-4ABA4CEAA7EE}	Kycwuqk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-26-f2-90-68-27	Kycwuqk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kycwuqk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Kycwuqk.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kycwuqk.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F301953D-2CF5-4466-A463-4ABA4CEAA7EE}\42-26-f2-90-68-27	Kycwuqk.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\42-26-f2-90-68-27\WpadDecision = "0"	Kycwuqk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 2872	1448	36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe	28
PID 1448 wrote to memory of 2872	1448	36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe	28
PID 1448 wrote to memory of 2872	1448	36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe	28
PID 1448 wrote to memory of 2872	1448	36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe	28
PID 2752 wrote to memory of 2688	2752	Kycwuqk.exe	34
PID 2752 wrote to memory of 2688	2752	Kycwuqk.exe	34
PID 2752 wrote to memory of 2688	2752	Kycwuqk.exe	34
PID 2752 wrote to memory of 2688	2752	Kycwuqk.exe	34

C:\Users\Admin\AppData\Local\Temp\36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe
"C:\Users\Admin\AppData\Local\Temp\36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c md C:\windowss64
  2⤵
  PID:2872

C:\Program Files (x86)\Microsoft Wvsrpg\Kycwuqk.exe
"C:\Program Files (x86)\Microsoft Wvsrpg\Kycwuqk.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c md C:\windowss64
  2⤵
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Wvsrpg\Kycwuqk.exe

Filesize
362KB

MD5
cd804b50743313fef57970afe59ee4cb

SHA1
236559269a5e0b2b89f00f37adafc726e561e152

SHA256
36588e93c955af20e24a8f1f4c1474a3a97a8ee84eaf0e2dc31e8e9781ee6e2c

SHA512
aeca795b8a890ed215126e61a44bfb5c6c9ac2d299a141312e455d2b133abac510f08088c7746db7aee41cbfb9447942691ac9fe2d6af5a253d0a3730e68500e

Download Submit
memory/1448-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing