Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
19-07-2024 07:55
Static task
static1
Behavioral task
behavioral1
Sample
3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe
Resource
win10v2004-20240709-en
General
-
Target
3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe
-
Size
3.3MB
-
MD5
9a030f026375bcc6506c8d149998c357
-
SHA1
180d58e51c8dd5cfdbb8a3b3f4faf88104f86644
-
SHA256
3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2
-
SHA512
e48d91d9661a93408446314074687ea70b6072fa4ebc03d03cefcf8a8c3a35776106e351e56d3aacecd6281bf312e98351e20cb7d351609bdc92791ccdaecb3e
-
SSDEEP
49152:t/NUxi03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCz:t/+T0uDhEv4n4M
Malware Config
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
Chinese Botnet payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4164-0-0x0000000010000000-0x000000001001F000-memory.dmp unk_chinese_botnet behavioral2/memory/4164-4-0x0000000000400000-0x000000000074F000-memory.dmp unk_chinese_botnet -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exepid process 4164 3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exepid process 4164 3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe