chinese_generic_botnet | 6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
16-10-2023 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
Size

856KB
MD5

9b14670e40993215d783879335504569
SHA1

c989492b72c0f7db2a488fd7607e0caed2d9d9ec
SHA256

6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc
SHA512

75c5480a1b8df08ebaa98d3d108e962053d8b6024e5a6c766993d4c3239d358e3be384b7c4eefa3aa1594f4fbf6dda6f8cf18cca2a573797e8a037aa37a7a9ff
SSDEEP

24576:PtYP6FReFi/I2x+cgveqpAGU9AgIQaZdPAFaLZz:W0Gb2x+a3GIxabQaL9

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/2392-8696-0x0000000000400000-0x000000000051D000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 1 IoCs

pid	Process
1084	Terms.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\B:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\E:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\I:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\P:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\S:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\V:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\W:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\G:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\H:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\N:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\O:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\Z:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\U:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\X:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\K:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\L:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\Q:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\T:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\J:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\M:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\R:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened (read-only)	\??\Y:	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs

pid	Process
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Terms.exe	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
File opened for modification	C:\Program Files (x86)\Terms.exe	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2392	6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe

C:\Users\Admin\AppData\Local\Temp\6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe
"C:\Users\Admin\AppData\Local\Temp\6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc.exe"
1⤵
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2392

C:\Program Files (x86)\Terms.exe
"C:\Program Files (x86)\Terms.exe"
1⤵
- Executes dropped EXE
PID:1084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Terms.exe

Filesize
856KB

MD5
9b14670e40993215d783879335504569

SHA1
c989492b72c0f7db2a488fd7607e0caed2d9d9ec

SHA256
6e69b26d5167a83e3cf669b3d0ad47797894b3b84879b97585d5929cd3bc7adc

SHA512
75c5480a1b8df08ebaa98d3d108e962053d8b6024e5a6c766993d4c3239d358e3be384b7c4eefa3aa1594f4fbf6dda6f8cf18cca2a573797e8a037aa37a7a9ff

Download Submit
memory/1084-14232-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/1084-11249-0x0000000001DD0000-0x0000000001F51000-memory.dmp

Filesize
1.5MB

Download
memory/2392-846-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-811-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-818-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-812-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-822-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-824-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-820-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-826-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-848-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-830-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-832-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-834-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-838-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-836-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-840-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-842-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-844-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-0-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2392-828-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-816-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-862-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-854-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-856-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-860-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-858-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-850-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-864-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-866-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-868-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-870-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-872-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-2547-0x0000000001EB0000-0x0000000002031000-memory.dmp

Filesize
1.5MB

Download
memory/2392-8686-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-8691-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2392-8696-0x0000000000400000-0x000000000051D000-memory.dmp

Filesize
1.1MB

Download
memory/2392-814-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-852-0x0000000002160000-0x0000000002271000-memory.dmp

Filesize
1.1MB

Download
memory/2392-1-0x0000000075C00000-0x0000000075C47000-memory.dmp

Filesize
284KB

Download