chinese_generic_botnet | 42525e109fc534ac972d74fcb8c628528ddecc7c124ff1c0a5059139444f4165

General

Target

f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe
Size

283KB
MD5

f85b93364a678d47d4b54675dda1abc3
SHA1

e03b6b4d0690d66e323868e1243b32e2af947b0a
SHA256

42525e109fc534ac972d74fcb8c628528ddecc7c124ff1c0a5059139444f4165
SHA512

97e78d70291383bfbfbef98617294dc1eb61a757ece1eb88aea5036d913c0731fc2247c061d0261fd4cfa97e344b94bce0b55c7878ea6d85222206fae31c96bf
SSDEEP

6144:OKrLgPF8Q6JOI8WCjYd2XGSa/oZrUf0c/mH8M:OqkPaQ6JqVY2aAS1C8

Score

10^/10

chinese_generic_botnet botnet

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 3 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/2188-4-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet
behavioral1/memory/2188-7-0x0000000000400000-0x0000000002CD4000-memory.dmp	unk_chinese_botnet
behavioral1/memory/2460-23-0x0000000000400000-0x0000000002CD4000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 1 IoCs

Processes:

Kkouumo.exe

pid	Process
2460	Kkouumo.exe

Drops file in System32 directory 1 IoCs

Processes:

Kkouumo.exe

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Kkouumo.exe

Drops file in Program Files directory 2 IoCs

Processes:

f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Fbilag\Kkouumo.exe	f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Fbilag\Kkouumo.exe	f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 24 IoCs

Processes:

Kkouumo.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Kkouumo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F9B8F74-4AAE-48F7-8532-B5F1709EECD1}\WpadDecisionTime = 90505b4dae91da01	Kkouumo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-f8-d9-9c-85-99\WpadDecisionTime = 90505b4dae91da01	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Kkouumo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kkouumo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Kkouumo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00fa000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F9B8F74-4AAE-48F7-8532-B5F1709EECD1}	Kkouumo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F9B8F74-4AAE-48F7-8532-B5F1709EECD1}\WpadNetworkName = "Network 3"	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F9B8F74-4AAE-48F7-8532-B5F1709EECD1}\16-f8-d9-9c-85-99	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Kkouumo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Kkouumo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F9B8F74-4AAE-48F7-8532-B5F1709EECD1}\WpadDecisionReason = "1"	Kkouumo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{5F9B8F74-4AAE-48F7-8532-B5F1709EECD1}\WpadDecision = "0"	Kkouumo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-f8-d9-9c-85-99\WpadDecisionReason = "1"	Kkouumo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-f8-d9-9c-85-99\WpadDecision = "0"	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Kkouumo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Kkouumo.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Kkouumo.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-f8-d9-9c-85-99	Kkouumo.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Kkouumo.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Kkouumo.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe

pid	Process
2188	f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe

pid	Process
2188	f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exeKkouumo.exe

pid	Process
2188	f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe
2460	Kkouumo.exe

C:\Users\Admin\AppData\Local\Temp\f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f85b93364a678d47d4b54675dda1abc3_JaffaCakes118.exe"
1⤵
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of SetWindowsHookEx
PID:2188

C:\Program Files (x86)\Microsoft Fbilag\Kkouumo.exe
"C:\Program Files (x86)\Microsoft Fbilag\Kkouumo.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Fbilag\Kkouumo.exe

Filesize
283KB

MD5
f85b93364a678d47d4b54675dda1abc3

SHA1
e03b6b4d0690d66e323868e1243b32e2af947b0a

SHA256
42525e109fc534ac972d74fcb8c628528ddecc7c124ff1c0a5059139444f4165

SHA512
97e78d70291383bfbfbef98617294dc1eb61a757ece1eb88aea5036d913c0731fc2247c061d0261fd4cfa97e344b94bce0b55c7878ea6d85222206fae31c96bf

Download Submit
memory/2188-10-0x0000000004510000-0x00000000045CC000-memory.dmp

Filesize
752KB

Download
memory/2188-3-0x0000000000400000-0x0000000002CD4000-memory.dmp

Filesize
40.8MB

Download
memory/2188-4-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/2188-7-0x0000000000400000-0x0000000002CD4000-memory.dmp

Filesize
40.8MB

Download
memory/2188-9-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2188-2-0x0000000004510000-0x00000000045CC000-memory.dmp

Filesize
752KB

Download
memory/2188-1-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2460-17-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/2460-18-0x0000000000400000-0x0000000002CD4000-memory.dmp

Filesize
40.8MB

Download
memory/2460-23-0x0000000000400000-0x0000000002CD4000-memory.dmp

Filesize
40.8MB

Download
memory/2460-25-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download
memory/2460-29-0x0000000002D50000-0x0000000002E50000-memory.dmp

Filesize
1024KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads