chinese_generic_botnet | c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

Analysis

max time kernel
152s
max time network
123s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
28-10-2023 16:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57.exe
Size

492KB
MD5

d2f4b8ba426494cfd47d7a726d6d25e3
SHA1

a79d1c40049571a6646f6b4c9f74c09eb7f76aa6
SHA256

c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57
SHA512

92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c
SSDEEP

3072:oHgVbcBoTRMGUYnJjEFp8Qp5O8kd6LkLh3VNr4d3Pc0n5f5Uydp:IgZ+nRpXkU2hlNrWj5fO4

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/1280-0-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

pid	Process
1928	Ckgwvew.exe
2624	Ckgwvew.exe

Loads dropped DLL 7 IoCs

pid	Process
1928	Ckgwvew.exe
1928	Ckgwvew.exe
1928	Ckgwvew.exe
1928	Ckgwvew.exe
2624	Ckgwvew.exe
2624	Ckgwvew.exe
2624	Ckgwvew.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Ckgwvew.exe	c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57.exe
File opened for modification	C:\Program Files (x86)\Ckgwvew.exe	c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1280	c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1280	c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57.exe
1928	Ckgwvew.exe
2624	Ckgwvew.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2624	1928	Ckgwvew.exe	29
PID 1928 wrote to memory of 2624	1928	Ckgwvew.exe	29
PID 1928 wrote to memory of 2624	1928	Ckgwvew.exe	29
PID 1928 wrote to memory of 2624	1928	Ckgwvew.exe	29
PID 1928 wrote to memory of 2624	1928	Ckgwvew.exe	29
PID 1928 wrote to memory of 2624	1928	Ckgwvew.exe	29
PID 1928 wrote to memory of 2624	1928	Ckgwvew.exe	29

C:\Users\Admin\AppData\Local\Temp\c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57.exe
"C:\Users\Admin\AppData\Local\Temp\c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:1280

C:\Program Files (x86)\Ckgwvew.exe
"C:\Program Files (x86)\Ckgwvew.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Program Files (x86)\Ckgwvew.exe
  "C:\Program Files (x86)\Ckgwvew.exe" Win7
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of SetWindowsHookEx
  PID:2624

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
C:\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
C:\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
\Program Files (x86)\Ckgwvew.exe

Filesize
492KB

MD5
d2f4b8ba426494cfd47d7a726d6d25e3

SHA1
a79d1c40049571a6646f6b4c9f74c09eb7f76aa6

SHA256
c83c91e0b97667f5f98ab426cec8801e4bac66f1210e10018209633ab1390e57

SHA512
92daf50e03515cfe3643fcf82cbd7052aef63ce5c8bae3d70d90bd02b7d0c43ddaae3511183b492c355ad02a279c5c1b76cb2effafe531e7313bdaa96160c37c

Download Submit
memory/1280-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download