chinese_generic_botnet | 140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792

Analysis

max time kernel
162s
max time network
169s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
11-10-2023 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
Size

3.1MB
MD5

400fe1bf9c38fde2eeeabdd3a64f84b8
SHA1

388d67c3b424a3fd233350777fd87331b0390ebe
SHA256

140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792
SHA512

c393b2115d601677adaf5734bae5678143aa667d9ab0ee41df1c923e91a910a1ae86ec1da7baff5eb3a1336b1a88cd612b76ce47c3d13c6e7c5b170e1575fd03
SSDEEP

98304:hO01bIv+7IGM4oT57VJNcKRrcJS8jJrV4znx:hO01F8GM4MJN1RrcJzrV6x

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/2132-10642-0x0000000000400000-0x000000000087F000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 1 IoCs

pid	Process
612	Kwawawi.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\H:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\I:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\T:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\Y:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\Z:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\G:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\J:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\M:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\S:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\E:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\K:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\N:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\O:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\P:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\Q:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\U:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\W:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\L:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\R:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\V:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened (read-only)	\??\X:	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 26 IoCs

pid	Process
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Kwawawi.exe	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
File opened for modification	C:\Program Files (x86)\Kwawawi.exe	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2132	140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe

C:\Users\Admin\AppData\Local\Temp\140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe
"C:\Users\Admin\AppData\Local\Temp\140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792.exe"
1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2132

C:\Program Files (x86)\Kwawawi.exe
"C:\Program Files (x86)\Kwawawi.exe"
1⤵
- Executes dropped EXE
PID:612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Kwawawi.exe

Filesize
3.1MB

MD5
400fe1bf9c38fde2eeeabdd3a64f84b8

SHA1
388d67c3b424a3fd233350777fd87331b0390ebe

SHA256
140b06b8cf54f9542282146bbdf66dd20e4f37a20baca378bc69dfd48db32792

SHA512
c393b2115d601677adaf5734bae5678143aa667d9ab0ee41df1c923e91a910a1ae86ec1da7baff5eb3a1336b1a88cd612b76ce47c3d13c6e7c5b170e1575fd03

Download Submit
memory/612-15423-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/612-11251-0x00000000024D0000-0x0000000002651000-memory.dmp

Filesize
1.5MB

Download
memory/612-8702-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/2132-846-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-811-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-818-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-820-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-822-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-824-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-826-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-828-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-852-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-832-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-834-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-836-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-838-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-840-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-842-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-844-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-0-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/2132-848-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-830-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-814-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-864-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-856-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-858-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-860-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-862-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-854-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-866-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-868-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-870-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-872-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-2547-0x0000000002450000-0x00000000025D1000-memory.dmp

Filesize
1.5MB

Download
memory/2132-8686-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-8693-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/2132-816-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-812-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-10642-0x0000000000400000-0x000000000087F000-memory.dmp

Filesize
4.5MB

Download
memory/2132-850-0x0000000002770000-0x0000000002881000-memory.dmp

Filesize
1.1MB

Download
memory/2132-1-0x0000000076040000-0x0000000076087000-memory.dmp

Filesize
284KB

Download