chinese_generic_botnet | a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 16:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05.exe
Size

468KB
MD5

a34d6327f5e271b2a9160d95c31c3079
SHA1

dfb679c8136695f374c31901df459e1ff04b611f
SHA256

a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05
SHA512

644dce5494a540ae55fd71f6d39e628b69bc4f9248c1e1bf4be7051dae9de62207ca4fff93abf20129f9e1546e94cb430c8b1a1b514f732cfec481cb1c5bcfd9
SSDEEP

3072:GyfZbD3v5+6eRod1kPgGZmKa95wVo06OmRqIzEke+O:JfZ3vEaLWpmr95wS1OIFA

Score

10^/10

chinese_generic_botnet aspackv2 botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 3 IoCs

botnet

resource	yara_rule
behavioral1/memory/2932-2-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet
behavioral1/memory/2560-16-0x0000000000400000-0x0000000000493000-memory.dmp	unk_chinese_botnet
behavioral1/memory/2672-22-0x0000000000400000-0x0000000000493000-memory.dmp	unk_chinese_botnet

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0008000000012254-8.dat	aspack_v212_v242

Executes dropped EXE 2 IoCs

pid	Process
2560	Zybnilp.exe
2672	Zybnilp.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Zybnilp.exe	a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05.exe
File opened for modification	C:\Program Files (x86)\Zybnilp.exe	a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2932	a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2932	a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05.exe
2560	Zybnilp.exe
2672	Zybnilp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2672	2560	Zybnilp.exe	29
PID 2560 wrote to memory of 2672	2560	Zybnilp.exe	29
PID 2560 wrote to memory of 2672	2560	Zybnilp.exe	29
PID 2560 wrote to memory of 2672	2560	Zybnilp.exe	29

C:\Users\Admin\AppData\Local\Temp\a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05.exe
"C:\Users\Admin\AppData\Local\Temp\a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2932

C:\Program Files (x86)\Zybnilp.exe
"C:\Program Files (x86)\Zybnilp.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Zybnilp.exe
  "C:\Program Files (x86)\Zybnilp.exe" Win7
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2672

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Zybnilp.exe

Filesize
468KB

MD5
a34d6327f5e271b2a9160d95c31c3079

SHA1
dfb679c8136695f374c31901df459e1ff04b611f

SHA256
a63c167748663147e6cd4121290365a5f157c71f5860140b0660c593c09cae05

SHA512
644dce5494a540ae55fd71f6d39e628b69bc4f9248c1e1bf4be7051dae9de62207ca4fff93abf20129f9e1546e94cb430c8b1a1b514f732cfec481cb1c5bcfd9

Download Submit
memory/2560-10-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2560-9-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2560-16-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2672-18-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2672-22-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2932-0-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2932-1-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2932-2-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download