chinese_generic_botnet | 4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b

Resubmissions

18-10-2024 20:35

241018-zc7q1axald 10

18-10-2024 20:24

241018-y6plvawflb 10

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
Size

940KB
MD5

b36366f4a27987d6de47887b03f29c68
SHA1

6f290bd6c132ec5c824558a29bdf75d25ced94e3
SHA256

4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b
SHA512

a9441175872e88fc49482ef4707fad0e1f15a3ee1f4c74f3a2fafd3744968025d35ca61ed1905239a01df58511985e00708cdae7cb9acae4cca8b51032e02359
SSDEEP

24576:q4bDOphvGTO5+L0Un5cOoaPaoWXqEinqg4dNMBlqD9:HD2n+H5cOoUao+vib4rMu

Score

10^/10

chinese_generic_botnet botnet discovery

Malware Config

Signatures

Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
botnet chinese_generic_botnet

Chinese Botnet payload 2 IoCs

botnet

Processes:

resource	yara_rule
behavioral1/memory/1516-16493-0x0000000000400000-0x0000000000549000-memory.dmp	unk_chinese_botnet
behavioral1/memory/1928-16494-0x0000000000400000-0x0000000000549000-memory.dmp	unk_chinese_botnet

Executes dropped EXE 1 IoCs

Processes:

Dhttdfv.exe

pid process

1516 Dhttdfv.exe

pid	process
1516	Dhttdfv.exe

Drops file in System32 directory 1 IoCs

Processes:

Dhttdfv.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Dhttdfv.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 45 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exeDhttdfv.exe

pid	process
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1516	Dhttdfv.exe
1516	Dhttdfv.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1516	Dhttdfv.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1516	Dhttdfv.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1516	Dhttdfv.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1516	Dhttdfv.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1516	Dhttdfv.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1516	Dhttdfv.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
1928	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe

Drops file in Program Files directory 2 IoCs

Processes:

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe

description	ioc	process
File created	C:\Program Files (x86)\Dhttdfv.exe	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
File opened for modification	C:\Program Files (x86)\Dhttdfv.exe	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

SecuriteInfo.com.Win32.RATX-gen.32303.15212.exeDhttdfv.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Dhttdfv.exe

Modifies data under HKEY_USERS 24 IoCs

Processes:

Dhttdfv.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Dhttdfv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Dhttdfv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Dhttdfv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{788A0A1D-7D7F-4D43-AE7F-1A1C41184F5A}	Dhttdfv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{788A0A1D-7D7F-4D43-AE7F-1A1C41184F5A}\WpadNetworkName = "Network 3"	Dhttdfv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{788A0A1D-7D7F-4D43-AE7F-1A1C41184F5A}\de-0f-8c-df-8a-7f	Dhttdfv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-0f-8c-df-8a-7f	Dhttdfv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Dhttdfv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Dhttdfv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Dhttdfv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Dhttdfv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{788A0A1D-7D7F-4D43-AE7F-1A1C41184F5A}\WpadDecisionTime = 20af0ed39b21db01	Dhttdfv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{788A0A1D-7D7F-4D43-AE7F-1A1C41184F5A}\WpadDecision = "0"	Dhttdfv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-0f-8c-df-8a-7f\WpadDecision = "0"	Dhttdfv.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Dhttdfv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Dhttdfv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Dhttdfv.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Dhttdfv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{788A0A1D-7D7F-4D43-AE7F-1A1C41184F5A}\WpadDecisionReason = "1"	Dhttdfv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-0f-8c-df-8a-7f\WpadDecisionTime = 20af0ed39b21db01	Dhttdfv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Dhttdfv.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Dhttdfv.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00e5000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Dhttdfv.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\de-0f-8c-df-8a-7f\WpadDecisionReason = "1"	Dhttdfv.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.32303.15212.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:1928

C:\Program Files (x86)\Dhttdfv.exe
"C:\Program Files (x86)\Dhttdfv.exe"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Dhttdfv.exe

Filesize
940KB

MD5
b36366f4a27987d6de47887b03f29c68

SHA1
6f290bd6c132ec5c824558a29bdf75d25ced94e3

SHA256
4cc1ab70e6fd0d4441c778d40212c6e3114e14d56da85717214f8498e1c1501b

SHA512
a9441175872e88fc49482ef4707fad0e1f15a3ee1f4c74f3a2fafd3744968025d35ca61ed1905239a01df58511985e00708cdae7cb9acae4cca8b51032e02359

Download Submit
memory/1516-16493-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1516-7792-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1928-544-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-526-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-520-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-540-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-546-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-538-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-507-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-564-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-562-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-560-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-558-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-554-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-552-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-550-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-548-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-0-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download
memory/1928-1-0x00000000759A0000-0x00000000759E7000-memory.dmp

Filesize
284KB

Download
memory/1928-511-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-556-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-536-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-534-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-532-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-530-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-528-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-524-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-522-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-518-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-516-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-514-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-512-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-508-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-504-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-503-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-542-0x0000000002140000-0x0000000002251000-memory.dmp

Filesize
1.1MB

Download
memory/1928-16494-0x0000000000400000-0x0000000000549000-memory.dmp

Filesize
1.3MB

Download