chinese_generic_botnet | 72dcae28c87c8d1a41d98c15c77c08edf196504dda8edc87b97e7c98f13d9499 | Triage

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-03-2024 03:00

Sharing

Report Analysis Logs

General

Target

b10ce2b16a7954f8c37eedbe0f1bd32b.exe
Size

2.0MB
MD5

b10ce2b16a7954f8c37eedbe0f1bd32b
SHA1

32b3706b588f3db4088418918eb860e835c9fe21
SHA256

72dcae28c87c8d1a41d98c15c77c08edf196504dda8edc87b97e7c98f13d9499
SHA512

e7f291d0c9a447f858be0464f5d53e518966f0458a978489501b4c684d6f3c99fb7db0ede30dbd5b76b1cec03d3c75fa43a25f66b1d64d498deab943b1ed4a62
SSDEEP

49152:WYHkNRgHwCEeDBw24v9dsMY453F/Ar44Avp:JHkNcYTY4536q

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

resource	yara_rule
behavioral1/memory/2280-0-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2280	b10ce2b16a7954f8c37eedbe0f1bd32b.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2280	b10ce2b16a7954f8c37eedbe0f1bd32b.exe

C:\Users\Admin\AppData\Local\Temp\b10ce2b16a7954f8c37eedbe0f1bd32b.exe
"C:\Users\Admin\AppData\Local\Temp\b10ce2b16a7954f8c37eedbe0f1bd32b.exe"
1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2280

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2280-0-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download