Analysis
-
max time kernel
150s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
18-12-2023 12:11
Static task
static1
Behavioral task
behavioral1
Sample
7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe
Resource
win10v2004-20231215-en
General
-
Target
7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe
-
Size
3.3MB
-
MD5
e0f631821a04fef380be55b96bd60abd
-
SHA1
8a46c64b1d54c4b73d6910ec2e164a75e9842ebe
-
SHA256
7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b
-
SHA512
dcb08021fa5aa76a8f9d3208f21ac17074f918e08c2d161592d9e6c624c2017b276283af9c5e23b6edf86a39b4d660e358d407d216ec203fcca0f7692c6751a4
-
SSDEEP
49152:t/Xxi03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCz:t/XT0uDhEv4n4M
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
resource yara_rule behavioral1/memory/1944-0-0x0000000010000000-0x000000001001F000-memory.dmp unk_chinese_botnet -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\Terms.exe" 7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Terms.exe 7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe File opened for modification C:\Windows\Terms.exe 7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1944 7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1944 7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe"C:\Users\Admin\AppData\Local\Temp\7f249573f54d10deb2a4504508b55e55ad865b3000d9ab01e13952a932ff3a5b.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1944