Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
28-03-2024 04:00
General
-
Target
eb9317747dfd34d2f41cf90640de4d7c37211fba1f52b25f34de5c7389ab7d0d.exe
-
Size
8.3MB
-
MD5
34b21663dcf4837afbbb4265a101085f
-
SHA1
59d5d64e43fe90448746af582cd0a48a4add34bf
-
SHA256
eb9317747dfd34d2f41cf90640de4d7c37211fba1f52b25f34de5c7389ab7d0d
-
SHA512
c4bfaf3fdf6565539462c70b7a60fd63a30477308fbfc5095880c7cd4b1d9f923d4b07bcb45a3224416152624a22a3d6102051583a141577728730b8269a17d9
-
SSDEEP
49152:t/GUxi03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCzj:t/GUT0uDhEv4n4Ma
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 1 IoCs
-
Executes dropped EXE 2 IoCs
-
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Drops file in Program Files directory 2 IoCs
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious behavior: RenamesItself 1 IoCs
-
Suspicious use of SetWindowsHookEx 3 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb9317747dfd34d2f41cf90640de4d7c37211fba1f52b25f34de5c7389ab7d0d.exe"C:\Users\Admin\AppData\Local\Temp\eb9317747dfd34d2f41cf90640de4d7c37211fba1f52b25f34de5c7389ab7d0d.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Uoiksum.exe"C:\Program Files (x86)\Uoiksum.exe"1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Uoiksum.exe"C:\Program Files (x86)\Uoiksum.exe" Win72⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4.4MB
MD58a7eb60525c0d0cb3440d784e50db751
SHA176feebdf9ae67b9b8737b97670923f3974798397
SHA2562c4c8f1e27e951dd87fbbf34e13acc06495b479a9c4deae3ae484de5aad113e9
SHA512133c35d5b6e64cc28dbd1f009d2a027c08d9fab595fc4b6ff7a455e5f7ae45201e2da09ec25e409fc9cf278587ca787d5b167a82e0acd6d8049db85e145a21db
-
Filesize
4.5MB
MD56f10b57f7ce98946f38572aa75c43021
SHA12b05a70d20b4709ef1f786079bf896dfd34da36a
SHA2565d6c73122c560b7477cf9de324201325475368c8e9cd5127af0db5897bc5413c
SHA512d08ceae3578dd165a67cf787bf104affa7440a16e536224bdf1a57deee85832d5bd3d5b8d7d3cb23c644a3f3f916eecc10ee402f78dccfc1e65d5c415ae1cd8d
-
Filesize
5.8MB
MD5a47dcba3c7f73992a7e89154cf8a818f
SHA1e0963cff1fbe960d9ed7f90689ad04e32b23222e
SHA256a9e522afa7757b8224691d5356bf50f5e72d62861a0cf0f7dae10682164c83b5
SHA51268e5056ab1db30b5f22d7202ad627389b0c7982e100167153ae1cfa642c8c88b720b9be8578235da5d4a619b365c36eb91d37c21dbc6bacf7acd69a69227b9c7
-
Filesize
124KB