chinese_generic_botnet | 87930e435af99eda9ad298493193b5ca78d4c3aeba7747158f2e983e8ee4445f

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03-01-2024 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ae32ad159d126278d9f7fc94f96adfa.exe
Size

3.3MB
MD5

9ae32ad159d126278d9f7fc94f96adfa
SHA1

59469daf99f9fbc0b83d9fc1128af4e313f89b1b
SHA256

87930e435af99eda9ad298493193b5ca78d4c3aeba7747158f2e983e8ee4445f
SHA512

f32059f93e209e5baf435388e31411efea05140668a67267eeb3354efd0d7e028f2df5aa293bfea50f2878340f4c71d8b608de35ed1c4e7be3a54760fa1a0787
SSDEEP

49152:2jH5mJX9IvGtO0j8DlojeoQcXiG7e26q/+M:2jH5mJywKyZLF

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/2472-0-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

pid	Process
2992	Ioiowwu.exe
2652	Ioiowwu.exe

Loads dropped DLL 1 IoCs

pid	Process
2992	Ioiowwu.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Ioiowwu.exe	9ae32ad159d126278d9f7fc94f96adfa.exe
File created	C:\Program Files (x86)\Ioiowwu.exe	9ae32ad159d126278d9f7fc94f96adfa.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2472	9ae32ad159d126278d9f7fc94f96adfa.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2472	9ae32ad159d126278d9f7fc94f96adfa.exe
2992	Ioiowwu.exe
2652	Ioiowwu.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 2652	2992	Ioiowwu.exe	29
PID 2992 wrote to memory of 2652	2992	Ioiowwu.exe	29
PID 2992 wrote to memory of 2652	2992	Ioiowwu.exe	29
PID 2992 wrote to memory of 2652	2992	Ioiowwu.exe	29

C:\Users\Admin\AppData\Local\Temp\9ae32ad159d126278d9f7fc94f96adfa.exe
"C:\Users\Admin\AppData\Local\Temp\9ae32ad159d126278d9f7fc94f96adfa.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2472

C:\Program Files (x86)\Ioiowwu.exe
"C:\Program Files (x86)\Ioiowwu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Ioiowwu.exe
  "C:\Program Files (x86)\Ioiowwu.exe" Win7
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2652

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Ioiowwu.exe

Filesize
604KB

MD5
ef5eaf72d87e653b59615b83bae7d29a

SHA1
9fe19eddb8d2f1aa427882cbd54cabdc9381d2bf

SHA256
1930a5f645801c3c014f1d5ef303aef867dd580d5d5c8a4d9ed2994792cbc9e6

SHA512
382b1f43dad904f994afc29b7b4f8ac4d4ffb5cf8635632d116e0fc06edc9eaf903e439df6311c17513e5d79503b2b18316818bce22443ffaa9e828fb3baac80

Download Submit
C:\Program Files (x86)\Ioiowwu.exe

Filesize
384KB

MD5
2f088309eb997d137860367b1df36dda

SHA1
8cdc1c8a3197abf41bc3e34059cc820599d4d27e

SHA256
6e3f56a1916a2aa2fecb9ddfdc3411187dbdf1856e5fc5ace0b832ef6dae5c75

SHA512
225515810c32da41cf949f98e5054e0ae395370bb073dd67db509736b1cd24b9a6a5068856db3867c1f4a6454d87efa6b0a0ff88dd72a3bedece6c9783209a4e

Download Submit
C:\Program Files (x86)\Ioiowwu.exe

Filesize
448KB

MD5
e5675d147fc66cb9180760627e3596ee

SHA1
fa9c9ff3795ce433a885ab4ac448d8488bb62fb0

SHA256
34ffe007c5969e495804f6fb2f77efd06d0afd2d8c7d2988434b21a06f021ef6

SHA512
4b09705060c85156f6aa80acfae632d8bccd7f3c1d981be0c161a5433613fd075cc656e72763fd0f8e543fa8f7b433b6b43ae9bd19293b29fa1cd52974b4a360

Download Submit
\Program Files (x86)\Ioiowwu.exe

Filesize
462KB

MD5
da7d2381a7c6c20b8a26c1575100f742

SHA1
499eb02894e9c21cf4802d0c7c4ac85abad8421d

SHA256
9907416fbf5447ffc0b1c8fdbd9e6558eb713a6d963e3d5096f8bb2e1312fa77

SHA512
ba70fa4aeabbefc7877ab14b1fb3b631fc9b55e18152a529f6fa08f0114c783e690a96bc4b8cc5f09666943a35485eba5a154839402e5aa61e0530eead454c64

Download Submit
memory/2472-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download