chinese_generic_botnet | 78d584b482cc097815d1beae4043a6533192670bd5214f3e920907326fe64ae6

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2024 12:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

544f8dfee031d02135551937f709db68_JaffaCakes118.dll
Size

536KB
MD5

544f8dfee031d02135551937f709db68
SHA1

ed82e2e0bbd8a1efeb430dd625e120447bcf1a45
SHA256

78d584b482cc097815d1beae4043a6533192670bd5214f3e920907326fe64ae6
SHA512

03500354c8c3d4e4698c659f0a15db75d45586d9253ecd4ffcc0e4b53de11c97d3750217198f95b760093524c893b8ec7cba0fb472189c3239a3c87f2dfca6cf
SSDEEP

6144:0nlQpnkPAfVUCaJBr7kaCLfepSyRntuoJF:0nlQpkPAfiCaJBr2yptp

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral2/memory/5092-0-0x0000000000B50000-0x0000000000B68000-memory.dmp	unk_chinese_botnet

Blocklisted process makes network request 41 IoCs

flow	pid	Process
5	5092	rundll32.exe
28	5092	rundll32.exe
29	5092	rundll32.exe
30	5092	rundll32.exe
43	5092	rundll32.exe
44	5092	rundll32.exe
45	5092	rundll32.exe
46	5092	rundll32.exe
47	5092	rundll32.exe
48	5092	rundll32.exe
49	5092	rundll32.exe
50	5092	rundll32.exe
51	5092	rundll32.exe
54	5092	rundll32.exe
56	5092	rundll32.exe
57	5092	rundll32.exe
58	5092	rundll32.exe
59	5092	rundll32.exe
60	5092	rundll32.exe
61	5092	rundll32.exe
62	5092	rundll32.exe
65	5092	rundll32.exe
67	5092	rundll32.exe
71	5092	rundll32.exe
72	5092	rundll32.exe
73	5092	rundll32.exe
74	5092	rundll32.exe
75	5092	rundll32.exe
76	5092	rundll32.exe
77	5092	rundll32.exe
78	5092	rundll32.exe
79	5092	rundll32.exe
80	5092	rundll32.exe
81	5092	rundll32.exe
82	5092	rundll32.exe
83	5092	rundll32.exe
84	5092	rundll32.exe
85	5092	rundll32.exe
86	5092	rundll32.exe
87	5092	rundll32.exe
88	5092	rundll32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ywaqysm.exe = "C:\\Windows\\SysWOW64\\rundll32.exe"	rundll32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 5092	4752	rundll32.exe	83
PID 4752 wrote to memory of 5092	4752	rundll32.exe	83
PID 4752 wrote to memory of 5092	4752	rundll32.exe	83

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\544f8dfee031d02135551937f709db68_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\544f8dfee031d02135551937f709db68_JaffaCakes118.dll,#1
  2⤵
  - Blocklisted process makes network request
  - Adds Run key to start application
  PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/5092-0-0x0000000000B50000-0x0000000000B68000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads