chinese_generic_botnet | 8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
07-12-2023 20:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe
Size

4.1MB
MD5

c862a8af9c31b5be4a50b17282630eaf
SHA1

d8653926e68fa30b3a7bfa382dc337f557d5c709
SHA256

8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110
SHA512

70b4afb66f53c34ef364cbb2d109c33a993706a12603b3536e004081b6d4d0361f81a96e0a151e7f9fc970004e4c3c407f7e7475e4fc74a86fb2d71672debd9a
SSDEEP

49152:9QWqHcFt4tQGgKbDLKykKy5RyeEJzrlrx:9QWWcFt4t5gKbDLKykKy5QVJzJrx

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

resource	yara_rule
behavioral1/memory/1348-6-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet
behavioral1/memory/2584-25-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 7 IoCs

pid	Process
1348	svchost.exe
952	js.exe
2584	svichost.exe
2764	Qgymwes.exe
2516	Gouarlv.exe
2548	Qgymwes.exe
1536	Gouarlv.exe

Loads dropped DLL 2 IoCs

pid	Process
952	js.exe
952	js.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ÎÒµÄÆô¶¯Ïî = "C:\\Windows\\System32\\svichost.exe"	js.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\S:	svchost.exe
File opened (read-only)	\??\V:	svchost.exe
File opened (read-only)	\??\Y:	svchost.exe
File opened (read-only)	\??\E:	svchost.exe
File opened (read-only)	\??\H:	svchost.exe
File opened (read-only)	\??\N:	svchost.exe
File opened (read-only)	\??\O:	svchost.exe
File opened (read-only)	\??\R:	svchost.exe
File opened (read-only)	\??\X:	svchost.exe
File opened (read-only)	\??\B:	svchost.exe
File opened (read-only)	\??\G:	svchost.exe
File opened (read-only)	\??\W:	svchost.exe
File opened (read-only)	\??\T:	svchost.exe
File opened (read-only)	\??\I:	svchost.exe
File opened (read-only)	\??\J:	svchost.exe
File opened (read-only)	\??\K:	svchost.exe
File opened (read-only)	\??\L:	svchost.exe
File opened (read-only)	\??\M:	svchost.exe
File opened (read-only)	\??\P:	svchost.exe
File opened (read-only)	\??\Q:	svchost.exe
File opened (read-only)	\??\U:	svchost.exe
File opened (read-only)	\??\Z:	svchost.exe

Drops file in System32 directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Qgymwes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Gouarlv.exe
File created	C:\Windows\SysWOW64\svichost.exe	js.exe
File opened for modification	C:\Windows\SysWOW64\svichost.exe	js.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Qgymwes.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Gouarlv.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe	svchost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe	svchost.exe
File created	C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe	svichost.exe
File opened for modification	C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe	svichost.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\svchost.exe	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe
File created	C:\Windows\js.exe	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe

Modifies data under HKEY_USERS 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDecision = "0"	Gouarlv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadNetworkName = "Network 3"	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadNetworkName = "Network 3"	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Qgymwes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDecisionTime = f0ea1c244829da01	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Qgymwes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadDecisionTime = 50fb3a2c4829da01	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDecisionTime = f0ea1c244829da01	Qgymwes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDecisionTime = f0cb18294829da01	Gouarlv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Gouarlv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDetectedUrl	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\56-38-7f-13-e7-ba	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Gouarlv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDecisionReason = "1"	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDecisionTime = f09fcc284829da01	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba	Qgymwes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDecision = "0"	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadDecision = "0"	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Gouarlv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadDecisionReason = "1"	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadDecisionReason = "1"	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Qgymwes.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}	Qgymwes.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Gouarlv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000005000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadDecisionReason = "1"	Qgymwes.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadDecisionTime = f09fcc284829da01	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Gouarlv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{83C5DCDF-5EDD-4E9A-827F-DBAE97927D6A}\WpadDecision = "0"	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Gouarlv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Qgymwes.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Gouarlv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\56-38-7f-13-e7-ba\WpadDetectedUrl	Gouarlv.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
952	js.exe
1348	svchost.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe
2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe
1348	svchost.exe
952	js.exe
952	js.exe
2584	svichost.exe
2764	Qgymwes.exe
2516	Gouarlv.exe
2548	Qgymwes.exe
1536	Gouarlv.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1348	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	28
PID 2320 wrote to memory of 1348	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	28
PID 2320 wrote to memory of 1348	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	28
PID 2320 wrote to memory of 1348	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	28
PID 2320 wrote to memory of 952	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	29
PID 2320 wrote to memory of 952	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	29
PID 2320 wrote to memory of 952	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	29
PID 2320 wrote to memory of 952	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	29
PID 2320 wrote to memory of 952	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	29
PID 2320 wrote to memory of 952	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	29
PID 2320 wrote to memory of 952	2320	8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe	29
PID 952 wrote to memory of 2584	952	js.exe	30
PID 952 wrote to memory of 2584	952	js.exe	30
PID 952 wrote to memory of 2584	952	js.exe	30
PID 952 wrote to memory of 2584	952	js.exe	30
PID 2764 wrote to memory of 2548	2764	Qgymwes.exe	36
PID 2764 wrote to memory of 2548	2764	Qgymwes.exe	36
PID 2764 wrote to memory of 2548	2764	Qgymwes.exe	36
PID 2764 wrote to memory of 2548	2764	Qgymwes.exe	36
PID 2516 wrote to memory of 1536	2516	Gouarlv.exe	37
PID 2516 wrote to memory of 1536	2516	Gouarlv.exe	37
PID 2516 wrote to memory of 1536	2516	Gouarlv.exe	37
PID 2516 wrote to memory of 1536	2516	Gouarlv.exe	37

C:\Users\Admin\AppData\Local\Temp\8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe
"C:\Users\Admin\AppData\Local\Temp\8688fbe0d85a42a96cc8a337e882ab267fe450e847351b6866e08ecd1bfe3110.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\svchost.exe
  C:\Windows\\svchost.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Checks processor information in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1348
- C:\Windows\js.exe
  C:\Windows\\js.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\svichost.exe
    C:\Windows\System32\svichost.exe
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious use of SetWindowsHookEx
    PID:2584

C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe
"C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe
  "C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:2548

C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe
"C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe
  "C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe" Win7
  2⤵
  - Executes dropped EXE
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious use of SetWindowsHookEx
  PID:1536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe

Filesize
1.0MB

MD5
5e0bd14c0976831e38f6674892ed9ac6

SHA1
2d345b6ce9fb5c3f70353530f392c70b5776e95a

SHA256
35f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302

SHA512
4a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437

Download Submit
C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe

Filesize
1.0MB

MD5
5e0bd14c0976831e38f6674892ed9ac6

SHA1
2d345b6ce9fb5c3f70353530f392c70b5776e95a

SHA256
35f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302

SHA512
4a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437

Download Submit
C:\Program Files (x86)\Microsoft Eiwisc\Gouarlv.exe

Filesize
1.0MB

MD5
5e0bd14c0976831e38f6674892ed9ac6

SHA1
2d345b6ce9fb5c3f70353530f392c70b5776e95a

SHA256
35f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302

SHA512
4a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437

Download Submit
C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe

Filesize
1.0MB

MD5
98664a6bca78eab5cddd244e6762bae6

SHA1
81013aa881b4e45a76739a088d81ba4def2eed8d

SHA256
0acb639b41b26eea6d94fa0334b056bb8c6037c84ae15b3678356cf6697ef116

SHA512
8773e3da356b4dd6c464b8d4c38a43f425e89e1ba2968c92a9b9ac6650441d895419b16061b99c66fa89643760d6d4e898498fd4e69116c915f8831e1193bae8

Download Submit
C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe

Filesize
1.0MB

MD5
98664a6bca78eab5cddd244e6762bae6

SHA1
81013aa881b4e45a76739a088d81ba4def2eed8d

SHA256
0acb639b41b26eea6d94fa0334b056bb8c6037c84ae15b3678356cf6697ef116

SHA512
8773e3da356b4dd6c464b8d4c38a43f425e89e1ba2968c92a9b9ac6650441d895419b16061b99c66fa89643760d6d4e898498fd4e69116c915f8831e1193bae8

Download Submit
C:\Program Files (x86)\Microsoft Qiaaoy\Qgymwes.exe

Filesize
1.0MB

MD5
98664a6bca78eab5cddd244e6762bae6

SHA1
81013aa881b4e45a76739a088d81ba4def2eed8d

SHA256
0acb639b41b26eea6d94fa0334b056bb8c6037c84ae15b3678356cf6697ef116

SHA512
8773e3da356b4dd6c464b8d4c38a43f425e89e1ba2968c92a9b9ac6650441d895419b16061b99c66fa89643760d6d4e898498fd4e69116c915f8831e1193bae8

Download Submit
C:\Windows\SysWOW64\svichost.exe

Filesize
1.0MB

MD5
5e0bd14c0976831e38f6674892ed9ac6

SHA1
2d345b6ce9fb5c3f70353530f392c70b5776e95a

SHA256
35f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302

SHA512
4a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437

Download Submit
C:\Windows\SysWOW64\svichost.exe

Filesize
1.0MB

MD5
5e0bd14c0976831e38f6674892ed9ac6

SHA1
2d345b6ce9fb5c3f70353530f392c70b5776e95a

SHA256
35f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302

SHA512
4a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437

Download Submit
C:\Windows\js.exe

Filesize
1.8MB

MD5
448a820e0d6b1125b7917fd16e87d905

SHA1
413c6f4a342772812ef2d27b550669b2ec0aefff

SHA256
0240fd72362dd0be296618dc46dd8c1ce2f3f5cd4132556454cf88f6e3393e36

SHA512
c73a4c53e723d971dc9beb0aa1816d68a86e61cb4b6925ad8d6fdc29b370a02b9b1b81a99590f29cdc2c02cdbd78ae4ccbca7d09db2c7b7d0cddb2f0946f937e

Download Submit
C:\Windows\js.exe

Filesize
1.8MB

MD5
448a820e0d6b1125b7917fd16e87d905

SHA1
413c6f4a342772812ef2d27b550669b2ec0aefff

SHA256
0240fd72362dd0be296618dc46dd8c1ce2f3f5cd4132556454cf88f6e3393e36

SHA512
c73a4c53e723d971dc9beb0aa1816d68a86e61cb4b6925ad8d6fdc29b370a02b9b1b81a99590f29cdc2c02cdbd78ae4ccbca7d09db2c7b7d0cddb2f0946f937e

Download Submit
C:\Windows\js.exe

Filesize
1.8MB

MD5
448a820e0d6b1125b7917fd16e87d905

SHA1
413c6f4a342772812ef2d27b550669b2ec0aefff

SHA256
0240fd72362dd0be296618dc46dd8c1ce2f3f5cd4132556454cf88f6e3393e36

SHA512
c73a4c53e723d971dc9beb0aa1816d68a86e61cb4b6925ad8d6fdc29b370a02b9b1b81a99590f29cdc2c02cdbd78ae4ccbca7d09db2c7b7d0cddb2f0946f937e

Download Submit
C:\Windows\svchost.exe

Filesize
1.0MB

MD5
98664a6bca78eab5cddd244e6762bae6

SHA1
81013aa881b4e45a76739a088d81ba4def2eed8d

SHA256
0acb639b41b26eea6d94fa0334b056bb8c6037c84ae15b3678356cf6697ef116

SHA512
8773e3da356b4dd6c464b8d4c38a43f425e89e1ba2968c92a9b9ac6650441d895419b16061b99c66fa89643760d6d4e898498fd4e69116c915f8831e1193bae8

Download Submit
C:\Windows\svchost.exe

Filesize
1.0MB

MD5
98664a6bca78eab5cddd244e6762bae6

SHA1
81013aa881b4e45a76739a088d81ba4def2eed8d

SHA256
0acb639b41b26eea6d94fa0334b056bb8c6037c84ae15b3678356cf6697ef116

SHA512
8773e3da356b4dd6c464b8d4c38a43f425e89e1ba2968c92a9b9ac6650441d895419b16061b99c66fa89643760d6d4e898498fd4e69116c915f8831e1193bae8

Download Submit
C:\Windows\svchost.exe

Filesize
1.0MB

MD5
98664a6bca78eab5cddd244e6762bae6

SHA1
81013aa881b4e45a76739a088d81ba4def2eed8d

SHA256
0acb639b41b26eea6d94fa0334b056bb8c6037c84ae15b3678356cf6697ef116

SHA512
8773e3da356b4dd6c464b8d4c38a43f425e89e1ba2968c92a9b9ac6650441d895419b16061b99c66fa89643760d6d4e898498fd4e69116c915f8831e1193bae8

Download Submit
\Windows\SysWOW64\svichost.exe

Filesize
1.0MB

MD5
5e0bd14c0976831e38f6674892ed9ac6

SHA1
2d345b6ce9fb5c3f70353530f392c70b5776e95a

SHA256
35f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302

SHA512
4a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437

Download Submit
\Windows\SysWOW64\svichost.exe

Filesize
1.0MB

MD5
5e0bd14c0976831e38f6674892ed9ac6

SHA1
2d345b6ce9fb5c3f70353530f392c70b5776e95a

SHA256
35f667c4f1cdd84b6eeb17d17047d0943a6fe72ea61a37295ef41d1b3fdd6302

SHA512
4a36d2c59d911517b27d0ac60db6c6a9c3e1e2a26c49aee3a7cc4985658bc881135fbb1ec7f2667147c7b9db015a9dfb7a7e57838180027dfe9e8f197c0cf437

Download Submit
memory/1348-6-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2584-25-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download