Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
20-03-2024 10:02
General
-
Target
364e39ff3161639a0349ba68540d66e94bca3aeec6e14136f7fc315a2802f3ba.exe
-
Size
3.0MB
-
MD5
de374f2ca7f0b71e2ee9626679be4276
-
SHA1
19b4bf11baf75dc623c19216aa425ab1eab64727
-
SHA256
364e39ff3161639a0349ba68540d66e94bca3aeec6e14136f7fc315a2802f3ba
-
SHA512
06c6f75e3e9087b501e9c65ac124771a23caca3929b803deac038ebe0c35c0077c3da0e1b8406bd71aaccb55002641d1dfc1bf26dc764846e3cd16ad6ebd43d6
-
SSDEEP
49152:V/CUxi03zDWi26fs2cWDAbcl7j1v4+9Ry4kjCfJ:V/CUT0uDhVv4n4Mk
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 4 IoCs
-
Executes dropped EXE 2 IoCs
-
Drops file in Program Files directory 2 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\364e39ff3161639a0349ba68540d66e94bca3aeec6e14136f7fc315a2802f3ba.exe"C:\Users\Admin\AppData\Local\Temp\364e39ff3161639a0349ba68540d66e94bca3aeec6e14136f7fc315a2802f3ba.exe"1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Isukdxe.exe"C:\Program Files (x86)\Isukdxe.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Isukdxe.exe"C:\Program Files (x86)\Isukdxe.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5a63e8d40c8f6847e2df4d68c245636fd
SHA1381733154846dc28cedfb3f06684606cf4f2270b
SHA256f921b9a2cef031fc2975196570ba51a9435f5d8b5ae0855d0b35677598514f6e
SHA512eda30f0bffa1947a240b006ccf70bd761be38c279612701188acc4f607f053796cf23a334f375ec813c4f65bc8ce30f6056d4cd6029af08f7cc6fef6bb62dfd3
-
Filesize
768KB
MD50dc0444b9b0b49d2a94ce9c074f3374a
SHA17e2351c3088ece35bd2edd3a694fa15772f6aed8
SHA2569a9ad10c7cde370e76ce288ab28a8777c236d83a3c9a72ac38730724f4851587
SHA5122af760d1eb95a970f2c3ffefd0f2b1d44c336ccef559ab4a1ad2729cdbcffda2924f5636d34d898a4f8767f49c5c79ce64afa18566043f861275c8f2f2860ce7
-
Filesize
3.0MB
MD5de374f2ca7f0b71e2ee9626679be4276
SHA119b4bf11baf75dc623c19216aa425ab1eab64727
SHA256364e39ff3161639a0349ba68540d66e94bca3aeec6e14136f7fc315a2802f3ba
SHA51206c6f75e3e9087b501e9c65ac124771a23caca3929b803deac038ebe0c35c0077c3da0e1b8406bd71aaccb55002641d1dfc1bf26dc764846e3cd16ad6ebd43d6
-
Filesize
124KB