Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
-
submitted
12-10-2023 12:57
General
-
Target
763194a3058c2e41538b00037e8800d9915dc74980b198e238ad35ea1462b544.exe
-
Size
488KB
-
MD5
4436d518407ead63ee90d453f1c686d6
-
SHA1
5e1aa769a29d52e987138cf8399063af5f9415fa
-
SHA256
763194a3058c2e41538b00037e8800d9915dc74980b198e238ad35ea1462b544
-
SHA512
b08475a6b98652719c6e0aa415522a07c7d953969b68c3888edc7c63216235c4729d8725992ff79ae8ccaa13e78a233edcbf464a447a585ba6298511494012df
-
SSDEEP
3072:Q5OsiQ79xzUcbK9LK/fzuaCrutJUwTTatvywC6/sUIdQKgJUESJ:27hoBO/fzxhTTatd/sUIdQoE
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\763194a3058c2e41538b00037e8800d9915dc74980b198e238ad35ea1462b544.exe"C:\Users\Admin\AppData\Local\Temp\763194a3058c2e41538b00037e8800d9915dc74980b198e238ad35ea1462b544.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Oiqsmmm.exe"C:\Program Files (x86)\Oiqsmmm.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Oiqsmmm.exe"C:\Program Files (x86)\Oiqsmmm.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
488KB
MD54436d518407ead63ee90d453f1c686d6
SHA15e1aa769a29d52e987138cf8399063af5f9415fa
SHA256763194a3058c2e41538b00037e8800d9915dc74980b198e238ad35ea1462b544
SHA512b08475a6b98652719c6e0aa415522a07c7d953969b68c3888edc7c63216235c4729d8725992ff79ae8ccaa13e78a233edcbf464a447a585ba6298511494012df
-
Filesize
488KB
MD54436d518407ead63ee90d453f1c686d6
SHA15e1aa769a29d52e987138cf8399063af5f9415fa
SHA256763194a3058c2e41538b00037e8800d9915dc74980b198e238ad35ea1462b544
SHA512b08475a6b98652719c6e0aa415522a07c7d953969b68c3888edc7c63216235c4729d8725992ff79ae8ccaa13e78a233edcbf464a447a585ba6298511494012df
-
Filesize
488KB
MD54436d518407ead63ee90d453f1c686d6
SHA15e1aa769a29d52e987138cf8399063af5f9415fa
SHA256763194a3058c2e41538b00037e8800d9915dc74980b198e238ad35ea1462b544
SHA512b08475a6b98652719c6e0aa415522a07c7d953969b68c3888edc7c63216235c4729d8725992ff79ae8ccaa13e78a233edcbf464a447a585ba6298511494012df
-
Filesize
96KB