chinese_generic_botnet | 999d43ee4c9a1ec38c0b00fc38abe0b29b13cc83983c6ee895cbb2768b29022d

Analysis

max time kernel
134s
max time network
156s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07-10-2023 08:33

Target

cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe
Size

472KB
MD5

762bff46f0d8459d2fd83a7dbc0b3103
SHA1

5fdddc577baaa0ba8c7fe6b88be254866c959321
SHA256

cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb
SHA512

38a1e73a7d3c36817f53311c016a4ddf724dee9531c419298ea1f4452f60e4786ff16f25f5c73e01b7b9af971cc5c1acd323f436667a60ad77a0348f0a3256b5
SSDEEP

6144:WWMjNEqWNAML6edtpVYWNTLq01CQoSE0iHjbRfKugGdGQ/UDlVJHaCV:Wvuq2RL3ddNT+LKugjNTJ6

Score

10^/10

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral26/memory/2392-0-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe

pid process

2392 cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe

pid	process
2392	cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe

C:\Users\Admin\AppData\Local\Temp\cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe
"C:\Users\Admin\AppData\Local\Temp\cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:2392

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

memory/2392-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download