Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
26-09-2023 23:38
General
-
Target
140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
-
Size
3.1MB
-
MD5
400fe1bf9c38fde2eeeabdd3a64f84b8
-
SHA1
388d67c3b424a3fd233350777fd87331b0390ebe
-
SHA256
140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792
-
SHA512
c393b2115d601677adaf5734bae5678143aa667d9ab0ee41df1c923e91a910a1ae86ec1da7baff5eb3a1336b1a88cd612b76ce47c3d13c6e7c5b170e1575fd03
-
SSDEEP
98304:hO01bIv+7IGM4oT57VJNcKRrcJS8jJrV4znx:hO01F8GM4MJN1RrcJzrV6x
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 35 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe"C:\Users\Admin\AppData\Local\Temp\140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe"1⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.5MB
-
Filesize
2.1MB
-
Filesize
1.6MB
-
Filesize
488KB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
4.5MB
-
Filesize
124KB
-
Filesize
4.5MB