Analysis

  • max time kernel
    121s
  • max time network
    144s
  • platform
    windows7_x64
  • resource
    win7-20231025-en
  • resource tags

    arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
  • submitted
    01/11/2023, 08:33

General

  • Target

    a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe

  • Size

    356KB

  • MD5

    94d9c90d061ebd0ab7381acbd76557e9

  • SHA1

    b83d3825315e838b6c3f043eea70619ff481fb41

  • SHA256

    a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b

  • SHA512

    1de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5

  • SSDEEP

    3072:jAAdrtr5NutIdzQnT81FQoSE0iHjbRhyxKugK34b8HB/ojT7Eik:hZ5NugPQoSE0iHjbRIxKugK34GB/ojTS

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Chinese Botnet payload 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe
    "C:\Users\Admin\AppData\Local\Temp\a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    PID:2612
  • C:\Program Files (x86)\Akmkkkg.exe
    "C:\Program Files (x86)\Akmkkkg.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:2684
    • C:\Program Files (x86)\Akmkkkg.exe
      "C:\Program Files (x86)\Akmkkkg.exe" Win7
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      PID:2616

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Akmkkkg.exe

    Filesize

    356KB

    MD5

    94d9c90d061ebd0ab7381acbd76557e9

    SHA1

    b83d3825315e838b6c3f043eea70619ff481fb41

    SHA256

    a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b

    SHA512

    1de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5

  • C:\Program Files (x86)\Akmkkkg.exe

    Filesize

    356KB

    MD5

    94d9c90d061ebd0ab7381acbd76557e9

    SHA1

    b83d3825315e838b6c3f043eea70619ff481fb41

    SHA256

    a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b

    SHA512

    1de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5

  • C:\Program Files (x86)\Akmkkkg.exe

    Filesize

    356KB

    MD5

    94d9c90d061ebd0ab7381acbd76557e9

    SHA1

    b83d3825315e838b6c3f043eea70619ff481fb41

    SHA256

    a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b

    SHA512

    1de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5

  • memory/2612-0-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB