chinese_generic_botnet | ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515

Analysis

max time kernel
150s
max time network
123s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
19-10-2023 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe
Size

3.3MB
MD5

4c2c1b495ec564c56c378b75b5f43381
SHA1

11571e5ffb21b432f2aa1cb47aa8700f75502f47
SHA256

ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515
SHA512

513676a5c627582b489fea3755b41b1b155ff8e5983957e6a65a835feeca6ed0dfb77814eb9671b90f1563a6d77d82acd7d4fbdbb6aa84ddfc419ae6ee3694d0
SSDEEP

49152:t/fCr0xi03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCz:t/fCgT0uDhEv4n4M

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/1368-0-0x0000000010000000-0x000000001001F000-memory.dmp	unk_chinese_botnet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3849525425-30183055-657688904-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\Ssciscs.exe"	ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Ssciscs.exe	ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe
File opened for modification	C:\Windows\Ssciscs.exe	ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1368	ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1368	ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe

C:\Users\Admin\AppData\Local\Temp\ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe
"C:\Users\Admin\AppData\Local\Temp\ebae15aba3e02649b04dd0ff7391fedd37f25fcafff43240cf74522b50a63515.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1368-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download