chinese_generic_botnet | b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139

Analysis

max time kernel
149s
max time network
138s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
20-03-2024 10:00

Target

b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe
Size

3.0MB
MD5

f4493c831d658f14c153d83f5c5078cb
SHA1

51e410cdb40e050961bc0ec9ae4890fe08133e87
SHA256

b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139
SHA512

b2900fcbe47a9d3ece2c43bad9f5ddc4c83ff6a8c50d9a5a5f972053a42bb8ae296ecd497d4f54e30032d8fd938114a8aadba6e9c8e7ddbcde7690b796386e40
SSDEEP

49152:V/ZqDriDxi03zDWi26fs2cWDAbcl7j1v4+9Ry4kjCfJ:V/ZTT0uDhVv4n4Mk

Score

10^/10

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/2128-0-0x0000000010000000-0x000000001001F000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 2 IoCs

Processes:

Ageeqsg.exeAgeeqsg.exe

pid process

2696 Ageeqsg.exe
3068 Ageeqsg.exe

pid	process
2696	Ageeqsg.exe
3068	Ageeqsg.exe

Drops file in Program Files directory 2 IoCs

Processes:

b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe

description	ioc	process
File created	C:\Program Files (x86)\Ageeqsg.exe	b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe
File opened for modification	C:\Program Files (x86)\Ageeqsg.exe	b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe

pid process

2128 b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe
Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exeAgeeqsg.exeAgeeqsg.exe

pid process

2128 b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe
2696 Ageeqsg.exe
3068 Ageeqsg.exe

pid	process
2128	b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

Ageeqsg.exe

description	pid	process	target process
PID 2696 wrote to memory of 3068	2696	Ageeqsg.exe	Ageeqsg.exe
PID 2696 wrote to memory of 3068	2696	Ageeqsg.exe	Ageeqsg.exe
PID 2696 wrote to memory of 3068	2696	Ageeqsg.exe	Ageeqsg.exe
PID 2696 wrote to memory of 3068	2696	Ageeqsg.exe	Ageeqsg.exe

C:\Program Files (x86)\Ageeqsg.exe

Filesize
3.0MB

MD5
f4493c831d658f14c153d83f5c5078cb

SHA1
51e410cdb40e050961bc0ec9ae4890fe08133e87

SHA256
b721f465619896e4803dd45f61ffaf78719c962d123bfc025fa8eb6a82929139

SHA512
b2900fcbe47a9d3ece2c43bad9f5ddc4c83ff6a8c50d9a5a5f972053a42bb8ae296ecd497d4f54e30032d8fd938114a8aadba6e9c8e7ddbcde7690b796386e40

Download Submit
memory/2128-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download