Analysis
-
max time kernel
6s -
max time network
25s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
-
submitted
18-11-2023 13:58
Errors
General
-
Target
0dc0fd50858154a5745bad7609ccca7dc0437554053d02322c854390d65fef41.exe
-
Size
4.1MB
-
MD5
ac8468f5689396034d8027c0cb95f238
-
SHA1
eadcaf2c305ef397a1ad6d3bda5c555629a6112b
-
SHA256
0dc0fd50858154a5745bad7609ccca7dc0437554053d02322c854390d65fef41
-
SHA512
7370ebff7e0dd23dd3d60b1e5bec913525ed81536f1afe40680221ae88e8775384f01db9d3071a412e4497306aaa5cced5e64b8465b8713eecd771806dfbcb99
-
SSDEEP
49152:EbcJtZwTZOW2KykLZKyqHJmzk/BgXB/3GE+w48BjNf:gCtZwTZO9KykLZKyYKxfnBjd
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
-
UPX packed file 25 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Suspicious use of SetWindowsHookEx 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dc0fd50858154a5745bad7609ccca7dc0437554053d02322c854390d65fef41.exe"C:\Users\Admin\AppData\Local\Temp\0dc0fd50858154a5745bad7609ccca7dc0437554053d02322c854390d65fef41.exe"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\svichost.exeC:\Windows\System32\svichost.exe2⤵
-
-
C:\Windows\SysWOW64\winloeon.exeC:\Windows\System32\winloeon.exe2⤵
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa39a7855 /state1:0x41c64e6d1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD50ad092f975662537cc6636970cadc1bb
SHA10b0b2613809939e127a05981ae017402414008ff
SHA256b919ee7f02f87c7595b6e662872f20995ed62131b27988f29fc6ff84e175b0a4
SHA512296e2a1d68080e902c0879d3333a65bf66616521add4e966ec9ddfb08312b1cf8c98e99de1764fde3aadbf1070076522412c6422a469079180ea43f494ce9de5
-
Filesize
1.0MB
MD50ad092f975662537cc6636970cadc1bb
SHA10b0b2613809939e127a05981ae017402414008ff
SHA256b919ee7f02f87c7595b6e662872f20995ed62131b27988f29fc6ff84e175b0a4
SHA512296e2a1d68080e902c0879d3333a65bf66616521add4e966ec9ddfb08312b1cf8c98e99de1764fde3aadbf1070076522412c6422a469079180ea43f494ce9de5
-
Filesize
1.0MB
MD55e0bd14c0976831e38f6674892ed9ac6
SHA12d345b6ce9fb5c3f70353530f392c70b5776e95a
SHA25635f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302
SHA5124a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437
-
Filesize
1.0MB
MD55e0bd14c0976831e38f6674892ed9ac6
SHA12d345b6ce9fb5c3f70353530f392c70b5776e95a
SHA25635f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302
SHA5124a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437
-
Filesize
1.0MB
MD55e0bd14c0976831e38f6674892ed9ac6
SHA12d345b6ce9fb5c3f70353530f392c70b5776e95a
SHA25635f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302
SHA5124a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437
-
Filesize
96KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
96KB