Analysis
-
max time kernel
130s -
max time network
141s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
-
submitted
21-10-2023 08:42
General
-
Target
935216541841ba95af66a03efc574a180bc0862fbfc2419852fc87f841babf47.exe
-
Size
576KB
-
MD5
0ae75a42a0aebfacb2edfb1a26b2b314
-
SHA1
6b713dcde7d47052961e1be32412aa90975a9a8b
-
SHA256
935216541841ba95af66a03efc574a180bc0862fbfc2419852fc87f841babf47
-
SHA512
fb1f8619f17b7723fc9eb30104cc749bd9f27fbb0606d092b395178fb410e2a33eaa9fc7e50726c809f122ab91d5aaaf02b31082102645345ae33667552cd63e
-
SSDEEP
3072:bvKTDDsv+QpB4SMW3iru8bjBMloAujO6VrXHtlhuJ5iKoN33lcPlSuf8RJjuTMSZ:byTn9xO3zIjBMC7jjA+33livfVG41Td
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\935216541841ba95af66a03efc574a180bc0862fbfc2419852fc87f841babf47.exe"C:\Users\Admin\AppData\Local\Temp\935216541841ba95af66a03efc574a180bc0862fbfc2419852fc87f841babf47.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Qyockky.exe"C:\Program Files (x86)\Qyockky.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Qyockky.exe"C:\Program Files (x86)\Qyockky.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576KB
MD50ae75a42a0aebfacb2edfb1a26b2b314
SHA16b713dcde7d47052961e1be32412aa90975a9a8b
SHA256935216541841ba95af66a03efc574a180bc0862fbfc2419852fc87f841babf47
SHA512fb1f8619f17b7723fc9eb30104cc749bd9f27fbb0606d092b395178fb410e2a33eaa9fc7e50726c809f122ab91d5aaaf02b31082102645345ae33667552cd63e
-
Filesize
576KB
MD50ae75a42a0aebfacb2edfb1a26b2b314
SHA16b713dcde7d47052961e1be32412aa90975a9a8b
SHA256935216541841ba95af66a03efc574a180bc0862fbfc2419852fc87f841babf47
SHA512fb1f8619f17b7723fc9eb30104cc749bd9f27fbb0606d092b395178fb410e2a33eaa9fc7e50726c809f122ab91d5aaaf02b31082102645345ae33667552cd63e
-
Filesize
576KB
MD50ae75a42a0aebfacb2edfb1a26b2b314
SHA16b713dcde7d47052961e1be32412aa90975a9a8b
SHA256935216541841ba95af66a03efc574a180bc0862fbfc2419852fc87f841babf47
SHA512fb1f8619f17b7723fc9eb30104cc749bd9f27fbb0606d092b395178fb410e2a33eaa9fc7e50726c809f122ab91d5aaaf02b31082102645345ae33667552cd63e
-
Filesize
96KB