Analysis
-
max time kernel
129s -
max time network
139s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
-
submitted
03-01-2024 14:44
General
-
Target
a9fb5137754333ef0be6bf6aa0255fdc7fe5386efc7ae7ca2e04bf4cbbddf047.exe
-
Size
3.3MB
-
MD5
1773b10d2a197c6ee4dad9a37cc8be3f
-
SHA1
7ea4eb251459f083a57842780fee1c88065150ec
-
SHA256
a9fb5137754333ef0be6bf6aa0255fdc7fe5386efc7ae7ca2e04bf4cbbddf047
-
SHA512
a248a453c17a80b5aadc7718a4db6be23bbf14b3de2c405d8a672eae8efc1e6495392e73e7e69273b08391efce206535b01f9d17876aa855880d638e222d939e
-
SSDEEP
49152:t/nk7xd03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCz:t/k7i0uDhEv4n4M
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9fb5137754333ef0be6bf6aa0255fdc7fe5386efc7ae7ca2e04bf4cbbddf047.exe"C:\Users\Admin\AppData\Local\Temp\a9fb5137754333ef0be6bf6aa0255fdc7fe5386efc7ae7ca2e04bf4cbbddf047.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Nnvnnrv.exe"C:\Program Files (x86)\Nnvnnrv.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Nnvnnrv.exe"C:\Program Files (x86)\Nnvnnrv.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
896KB
MD5b0ad582af59d92dd4666271bb6f15004
SHA1bd9463eeadc05e60bc6a39c6ed3b16af78160b90
SHA256cb24beb2d816cccc4b5fd0a43419d1785dc7f40f65fbbe5c46f65f099aa4e7b0
SHA512795d155bc939185bc37dc87451a3ad9fb8617323587a34a5ed3a1ef597eb426ecbecef3d39f973c001179fb36016193ceb52d9162598addca338d10c79669c4c
-
Filesize
513KB
MD5e24152fa0d308b640b09832afebd6c64
SHA14b179a2bb9799e1cd1c2948b02b5bde603d7b801
SHA2564b88e4f5f7d20c9060b8dabec575afd4bb63fa4c3a9b37989bc039e2cf520c2f
SHA51219ebfa778a6e7a041affba55bcd89963b5a0559301c2624f2c5cf3fa95abb00803d3851c3ddaa27bbfbab1cbd14f6a6b59d4c1ddd5a43d251a44112c20181bef
-
Filesize
2.4MB
MD5e73c07088918928518bee1eda7ae3bc2
SHA14e8ea47f2a8f5cee74b0caf9fdaad2bbff06bad7
SHA2561571e02cd5f252f86efcbbed79ae44f796dcfc55b48948c9b94f1e4e96e4714c
SHA5123df736b4d9ab17adf74bc932ec26b3765a12c1725d7003c713c6fbfa49685c18ccb9d55023397d1daab38f941ad594aaf12da1d901f55f75609d6b8d98b71583
-
Filesize
124KB