chinese_generic_botnet | 7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c

Analysis

max time kernel
149s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
11-07-2024 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe
Size

3.0MB
MD5

1b1b95966906e1e7252f1ccb5d1a7d48
SHA1

9a4e7915ebdd487421c8fb0d5d777151dbdf120d
SHA256

7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c
SHA512

19267b670d83bb3746ee5b9ae13efeabb4d0a68377456894e0ee1821b8bb37859c83da9991b8807d0c5b1ca89dc5da4a36ae3a15010a088ef4a4ccb9cf58fe0d
SSDEEP

49152:V/CAxi03zDWi26fs2cWDAbcl7j1v4+9Ry4kjCfJ:V/CAT0uDhVv4n4Mk

Score

10^/10

chinese_generic_botnet botnet persistence

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 1 IoCs

botnet

Processes:

resource	yara_rule
behavioral2/memory/3812-0-0x0000000010000000-0x000000001001F000-memory.dmp	unk_chinese_botnet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2650514177-1034912467-4025611726-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hwzbjye.scr = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe"	7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe

pid process

3812 7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe

pid	process
3812	7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe

C:\Users\Admin\AppData\Local\Temp\7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe
"C:\Users\Admin\AppData\Local\Temp\7bc28d02456cd0c3b4a952ba9cea849da6884848df86a071031efa362d96fc5c.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetWindowsHookEx
PID:3812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3812-0-0x0000000010000000-0x000000001001F000-memory.dmp

Filesize
124KB

Download