Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
27-12-2023 01:17
General
-
Target
9ae32ad159d126278d9f7fc94f96adfa.exe
-
Size
3.3MB
-
MD5
9ae32ad159d126278d9f7fc94f96adfa
-
SHA1
59469daf99f9fbc0b83d9fc1128af4e313f89b1b
-
SHA256
87930e435af99eda9ad298493193b5ca78d4c3aeba7747158f2e983e8ee4445f
-
SHA512
f32059f93e209e5baf435388e31411efea05140668a67267eeb3354efd0d7e028f2df5aa293bfea50f2878340f4c71d8b608de35ed1c4e7be3a54760fa1a0787
-
SSDEEP
49152:2jH5mJX9IvGtO0j8DlojeoQcXiG7e26q/+M:2jH5mJywKyZLF
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ae32ad159d126278d9f7fc94f96adfa.exe"C:\Users\Admin\AppData\Local\Temp\9ae32ad159d126278d9f7fc94f96adfa.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Ioiowwu.exe"C:\Program Files (x86)\Ioiowwu.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Ioiowwu.exe"C:\Program Files (x86)\Ioiowwu.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD5a73dc20b3057a1516dc3ff16fff31a6a
SHA1188b8a2e57b8ad6dbf3e702321972c86a2e192a4
SHA2564af4b3a51de274fcc82d310ea6974e738b4ddfbc09726aef474831b3f9ac21b4
SHA5126a180d810ea70b99c02d5dc98d6291f486330b039857aa1474e1afcf611324a9f1f55a3107c07058abc08e72183c057b15025feb959d4bcf1c597894a033497e
-
Filesize
1.6MB
MD5d65d02cd3b61d66a825f5c344d2e33df
SHA1ec5704ad0480d97f666fd07727aee7ea0806dd89
SHA25629d79ab3dcd5f16041db1611b48a3eca2a884396887d99e9cc4d0de3004be3f8
SHA512841562a6181e077f21c3dface133e250bfefeed0f4d901ed5eb2b060dff8d790db653fefb855750ce8796d1adccd55a68bf948c8111609dd27d36730e44a24cf
-
Filesize
753KB
MD54025b78b3e4ee5eb4138b166ceb2e785
SHA19537f0f90eb5d3de520af2146940e4b24610a411
SHA2562bdf4812fe692b4ed36c15786c66f5ae5eb8bd164ac258a2f4c321f4078b9855
SHA512d1baaf9d93d5a7087857de9871f56b9d9cbf712eda297195e7f50f654cdfa2064d3a4deb183c096913aeaaa7a4b15d1cced21d1afc2773fc805936003d112c9f
-
Filesize
96KB