chinese_generic_botnet | 8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa

General

Target

8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe
Size

683KB
MD5

3c18e92b342ee0899db68f2f80bf1585
SHA1

04f9ddbcfe58580295c9de966c1b752302b9703d
SHA256

8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa
SHA512

6b90c0e3c428117c5325aaa7e47edc9d0392140e8eff8ff0541acaf1593dfde90ded4340ca5bb9baed1895283ede5386364f94481aaac7dce5941e0663210dd8
SSDEEP

12288:FIZIJ8lG4fIFE+wM0QUeW/AxKD1pH6tKpjAriCACE1ppp/3GxmP1xoM+/hXB1gjU:SZIJ8lG4fIFEhM54IEP/CACCh2IfM5Xv

Score

10^/10

chinese_generic_botnet botnet vmprotect

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

resource	yara_rule
behavioral1/memory/1696-17-0x0000000010000000-0x0000000010018000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 3 IoCs

pid	Process
1696	3333333.exe
1960	JDNumberScreen.exe
2852	Gaagmqi.exe

Loads dropped DLL 8 IoCs

pid	Process
2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe
2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe
2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe
2288	WerFault.exe

VMProtect packed file 2 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

resource	yara_rule
behavioral1/files/0x00270000000147d5-12.dat	vmprotect
behavioral1/memory/1960-20-0x00000000011B0000-0x0000000001304000-memory.dmp	vmprotect

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Gaagmqi.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft Wiceuk\Gaagmqi.exe	3333333.exe
File opened for modification	C:\Program Files (x86)\Microsoft Wiceuk\Gaagmqi.exe	3333333.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2288	1960	WerFault.exe	29

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gaagmqi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Gaagmqi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Gaagmqi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35C3A577-F0CC-4CFC-AFB2-73DBBE00DD88}\WpadDecisionReason = "1"	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-c7-e5-d8-2a-4a	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Gaagmqi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gaagmqi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35C3A577-F0CC-4CFC-AFB2-73DBBE00DD88}	Gaagmqi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35C3A577-F0CC-4CFC-AFB2-73DBBE00DD88}\WpadDecision = "0"	Gaagmqi.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35C3A577-F0CC-4CFC-AFB2-73DBBE00DD88}\WpadNetworkName = "Network 3"	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Gaagmqi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Gaagmqi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00be000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35C3A577-F0CC-4CFC-AFB2-73DBBE00DD88}\b2-c7-e5-d8-2a-4a	Gaagmqi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-c7-e5-d8-2a-4a\WpadDecisionReason = "1"	Gaagmqi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Gaagmqi.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Gaagmqi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Gaagmqi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{35C3A577-F0CC-4CFC-AFB2-73DBBE00DD88}\WpadDecisionTime = 605955d909cdda01	Gaagmqi.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-c7-e5-d8-2a-4a\WpadDecisionTime = 605955d909cdda01	Gaagmqi.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\b2-c7-e5-d8-2a-4a\WpadDecision = "0"	Gaagmqi.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1696	3333333.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1696	3333333.exe
2852	Gaagmqi.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2224 wrote to memory of 1696	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	28
PID 2224 wrote to memory of 1696	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	28
PID 2224 wrote to memory of 1696	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	28
PID 2224 wrote to memory of 1696	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	28
PID 2224 wrote to memory of 1960	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	29
PID 2224 wrote to memory of 1960	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	29
PID 2224 wrote to memory of 1960	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	29
PID 2224 wrote to memory of 1960	2224	8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe	29
PID 1960 wrote to memory of 2288	1960	JDNumberScreen.exe	30
PID 1960 wrote to memory of 2288	1960	JDNumberScreen.exe	30
PID 1960 wrote to memory of 2288	1960	JDNumberScreen.exe	30
PID 1960 wrote to memory of 2288	1960	JDNumberScreen.exe	30

C:\Users\Admin\AppData\Local\Temp\8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe
"C:\Users\Admin\AppData\Local\Temp\8fd5513c98a7bc3476164cbc10e3a4d2fd01cf4561130ee38794156104c602aa.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Users\Admin\AppData\Local\Temp\3333333.exe
  "C:\Users\Admin\AppData\Local\Temp\3333333.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1696
- C:\Users\Admin\AppData\Local\Temp\JDNumberScreen.exe
  "C:\Users\Admin\AppData\Local\Temp\JDNumberScreen.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1960 -s 584
    3⤵
    - Loads dropped DLL
    - Program crash
    PID:2288

C:\Program Files (x86)\Microsoft Wiceuk\Gaagmqi.exe
"C:\Program Files (x86)\Microsoft Wiceuk\Gaagmqi.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\3333333.exe

Filesize
748KB

MD5
94febfb790dd667281a39ef721223eb8

SHA1
e6a1463b4efab77eb49f4f50657af3299647cf43

SHA256
491058d241900b54024e2182de42fac9cbf648922a69a757348689195f7da75f

SHA512
4c247a7acda401f38eeb9a248fa93bcb12e2d55f8c884fef6f8fd0c48a583763903dea43444994e3301f931326be3101b735cfea39af712c87bf4785c668466b

Download Submit
\Users\Admin\AppData\Local\Temp\JDNumberScreen.exe

Filesize
829KB

MD5
fd50dbca6ccc3242a53ce06c6814d784

SHA1
bc5603f3e30bd8b6839e2694b034a8545ef71d4f

SHA256
95e63537cacbbcc50c9041c8bab2cc772220a0ef994f246e4734b17d6f73c203

SHA512
f4f71f6d67169fe13c0a68e03594a9e97bdb09e7ec1adceeb923276f295c4820b70b2d2336618d68c06c689508ea96a0db14475cc3f6023a0bb8eee953a94cef

Download Submit
memory/1696-17-0x0000000010000000-0x0000000010018000-memory.dmp

Filesize
96KB

Download
memory/1960-20-0x00000000011B0000-0x0000000001304000-memory.dmp

Filesize
1.3MB

Download
memory/2224-0-0x0000000000220000-0x00000000002CC000-memory.dmp

Filesize
688KB

Download

Analysis

Sharing