Analysis

  • max time kernel
    150s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2024 07:55

General

  • Target

    3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe

  • Size

    3.3MB

  • MD5

    9a030f026375bcc6506c8d149998c357

  • SHA1

    180d58e51c8dd5cfdbb8a3b3f4faf88104f86644

  • SHA256

    3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2

  • SHA512

    e48d91d9661a93408446314074687ea70b6072fa4ebc03d03cefcf8a8c3a35776106e351e56d3aacecd6281bf312e98351e20cb7d351609bdc92791ccdaecb3e

  • SSDEEP

    49152:t/NUxi03zDWi26fs2cWDAbcl7jkv4+9Ry4kjCz:t/+T0uDhEv4n4M

Malware Config

Signatures

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Chinese Botnet payload 2 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe
    "C:\Users\Admin\AppData\Local\Temp\3297e588e3af18170e7708358b259374762343c50570c8ede59bb8ba455c72b2.exe"
    1⤵
    • Suspicious behavior: RenamesItself
    • Suspicious use of SetWindowsHookEx
    PID:4164

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4164-0-0x0000000010000000-0x000000001001F000-memory.dmp

    Filesize

    124KB

  • memory/4164-4-0x0000000000400000-0x000000000074F000-memory.dmp

    Filesize

    3.3MB