Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 01:36
Static task
static1
Behavioral task
behavioral1
Sample
57d55049a0bceaf021c28b7a7395c365e6402855b3122a8c165c381f5a7b1bd6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
57d55049a0bceaf021c28b7a7395c365e6402855b3122a8c165c381f5a7b1bd6.exe
Resource
win10v2004-20231215-en
General
-
Target
57d55049a0bceaf021c28b7a7395c365e6402855b3122a8c165c381f5a7b1bd6.exe
-
Size
3.3MB
-
MD5
6a8e1430e7d9394ba37636e62be5e9fb
-
SHA1
f53b02f63ee7be4c5d7b0e03faab0102f4dca537
-
SHA256
57d55049a0bceaf021c28b7a7395c365e6402855b3122a8c165c381f5a7b1bd6
-
SHA512
7eb63dfbdf1b26d18768f1d99a82ee6544d635bed3f60790f7329df5c09f5e59a47a38016e20bc58a1341b17a8df524273c5b91ad7ada4342b47159d693b16d8
-
SSDEEP
49152:T0UdoogeHa+Fw0TNMC2yvOPVGpI3tzlGCGc7gTmiue7vVwtWv:PpNw0TNMC0PVsUFlGCGSgyia0
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
resource yara_rule behavioral2/memory/4704-5-0x0000000010000000-0x000000001001F000-memory.dmp unk_chinese_botnet behavioral2/memory/4704-11-0x0000000000400000-0x0000000000BBE4C0-memory.dmp unk_chinese_botnet -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Egygekk.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\57d55049a0bceaf021c28b7a7395c365e6402855b3122a8c165c381f5a7b1bd6.exe" 57d55049a0bceaf021c28b7a7395c365e6402855b3122a8c165c381f5a7b1bd6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4704 57d55049a0bceaf021c28b7a7395c365e6402855b3122a8c165c381f5a7b1bd6.exe