Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231025-en -
resource tags
arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system -
submitted
01/11/2023, 08:33
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe
Resource
win7-20231025-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe
-
Size
356KB
-
MD5
94d9c90d061ebd0ab7381acbd76557e9
-
SHA1
b83d3825315e838b6c3f043eea70619ff481fb41
-
SHA256
a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b
-
SHA512
1de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5
-
SSDEEP
3072:jAAdrtr5NutIdzQnT81FQoSE0iHjbRhyxKugK34b8HB/ojT7Eik:hZ5NugPQoSE0iHjbRIxKugK34GB/ojTS
Score
10/10
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
resource yara_rule behavioral1/memory/2612-0-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Executes dropped EXE 2 IoCs
pid Process 2684 Akmkkkg.exe 2616 Akmkkkg.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\W: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\E: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\L: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\N: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\O: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\P: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\Q: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\T: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\V: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\H: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\M: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\X: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\Y: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\Z: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\K: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\U: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\I: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\J: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\S: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\B: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened (read-only) \??\G: a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Akmkkkg.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat Akmkkkg.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Akmkkkg.exe a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe File opened for modification C:\Program Files (x86)\Akmkkkg.exe a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe -
Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7 Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDecisionReason = "1" Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDecision = "0" Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\3a-47-d6-68-7c-f7 Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadDecisionReason = "1" Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadNetworkName = "Network 2" Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDecisionTime = 7068573f9e0cda01 Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadDecisionTime = 703e40449e0cda01 Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7} Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadDecisionReason = "1" Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7} Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadDecisionTime = 7068573f9e0cda01 Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDecisionReason = "1" Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadDecision = "0" Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDecision = "0" Akmkkkg.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadDecision = "0" Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDecisionTime = 703e40449e0cda01 Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\3a-47-d6-68-7c-f7 Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDecisionTime = 7068573f9e0cda01 Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7\WpadDetectedUrl Akmkkkg.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{54961B1A-3316-43A6-848B-A3E1304C42B7}\WpadNetworkName = "Network 2" Akmkkkg.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f007b000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad Akmkkkg.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\3a-47-d6-68-7c-f7 Akmkkkg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2612 a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2612 a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2684 wrote to memory of 2616 2684 Akmkkkg.exe 30 PID 2684 wrote to memory of 2616 2684 Akmkkkg.exe 30 PID 2684 wrote to memory of 2616 2684 Akmkkkg.exe 30 PID 2684 wrote to memory of 2616 2684 Akmkkkg.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe"C:\Users\Admin\AppData\Local\Temp\a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
PID:2612
-
C:\Program Files (x86)\Akmkkkg.exe"C:\Program Files (x86)\Akmkkkg.exe"1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Program Files (x86)\Akmkkkg.exe"C:\Program Files (x86)\Akmkkkg.exe" Win72⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
PID:2616
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
356KB
MD594d9c90d061ebd0ab7381acbd76557e9
SHA1b83d3825315e838b6c3f043eea70619ff481fb41
SHA256a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b
SHA5121de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5
-
Filesize
356KB
MD594d9c90d061ebd0ab7381acbd76557e9
SHA1b83d3825315e838b6c3f043eea70619ff481fb41
SHA256a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b
SHA5121de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5
-
Filesize
356KB
MD594d9c90d061ebd0ab7381acbd76557e9
SHA1b83d3825315e838b6c3f043eea70619ff481fb41
SHA256a5dce61c3ff74b85a8b9c0e0c85ab3fc7f9abfb0b193c3143350fd0465af368b
SHA5121de65f56b1c4ad7ea394711b7d1ed83f57584acab1f3dbe104b40815af1237fd9b69e4d40f103b60df42afbda32c514f6f16fa9560158630308ab9ab4152b6b5