Overview

overview

10

Static

static

3

3a0b717cda...aa.exe

windows7-x64

10

3a0b717cda...aa.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-12-2023 06:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    3a0b717cda988ab2974f1c7c812e9b497b6c9590dc961a4d886c5eb02f2477aa.exe

  • Size

    3.3MB

  • MD5

    4f9b66a83a0da44ff8d8bf183e31fbb4

  • SHA1

    29f1e2976ad452188a7f56f38641d7349a075230

  • SHA256

    3a0b717cda988ab2974f1c7c812e9b497b6c9590dc961a4d886c5eb02f2477aa

  • SHA512

    7e0ebd7782433ce6f2a71c4705c1bff1798671f3f282a72416eb31367350d46fe66d927f3c9179b1ef3a0b78e27a2127419e299add4a67fdc3b12591572aa70c

  • SSDEEP

    49152:t/zj2xi03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCz:t/zqT0uDhEv4n4M

Score
10/10
chinese_generic_botnetbotnetpersistence

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

    botnetchinese_generic_botnet
  • Chinese Botnet payload 1 IoCs
    botnet
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a0b717cda988ab2974f1c7c812e9b497b6c9590dc961a4d886c5eb02f2477aa.exe
    "C:\Users\Admin\AppData\Local\Temp\3a0b717cda988ab2974f1c7c812e9b497b6c9590dc961a4d886c5eb02f2477aa.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetWindowsHookEx
    PID:3852

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3852-0-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

    Download