Chinese Hacktool Set - file c.exe

Hunt Hypothesis

This detection rule identifies the presence of c.exe, a known artifact associated with the Chinese Hacktool set, which adversaries often deploy to establish persistence and conduct reconnaissance on compromised endpoints. Proactively hunting for this file in Azure Sentinel is critical because its low severity classification may cause it to be overlooked during routine monitoring, allowing attackers to maintain undetected footholds within the environment before escalating their activities.

YARA Rule

rule Dos_c {
	meta:
		description = "Chinese Hacktool Set - file c.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "3deb6bd52fdac6d5a3e9a91c585d67820ab4df78"
	strings:
		$s0 = "!Win32 .EXE." fullword ascii
		$s1 = ".MPRESS1" fullword ascii
		$s2 = ".MPRESS2" fullword ascii
		$s3 = "XOLEHLP.dll" fullword ascii
		$s4 = "</body></html>" fullword ascii
		$s8 = "DtcGetTransactionManagerExA" fullword ascii  /* Goodware String - occured 12 times */
		$s9 = "GetUserNameA" fullword ascii  /* Goodware String - occured 305 times */
	condition:
		uint16(0) == 0x5a4d and filesize < 100KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 7 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the “Chinese Hacktool Set - file c.exe” detection rule, along with recommended filters or exclusions:

• Microsoft Office Click-to-Run Updates

  • Scenario: The Microsoft Office update mechanism frequently extracts temporary files named c.exe (or similar short names) within the %ProgramFiles%\Common Files\microsoft shared\ClickToRun directory during scheduled background updates. This is a common pattern in enterprise environments using Office 365 ProPlus or LTSC.
  • Filter/Exclusion: Exclude processes where the Parent Image Path contains \Microsoft Office Click-to-Run\ and the file hash matches known Microsoft-signed binaries. Alternatively, whitelist the specific directory path: C:\Program Files\Microsoft Office Root\VFS\.

• Sysinternals PsExec Execution

  • Scenario: System administrators often use Sysinternals PsExec (psexec.exe) to deploy scripts or run remote commands across endpoints. When executing a command that involves copying or running a utility, PsExec may spawn a temporary executable named c.exe in the %Temp% folder of the target machine before launching the actual payload.
  • Filter/Exclusion: Create an exclusion for c.exe where the Parent Process Name is psexec.exe and the file path starts with C:\Windows\Temp\. Additionally, verify that the parent process is signed by “Microsoft Corporation.”

• Antivirus Real-Time Scanning Components

  • Scenario: Major EDR/Antivirus solutions (such as CrowdStrike Falcon or Symantec Endpoint Protection) utilize helper executables for real-time scanning modules. These components often manifest as c.exe within their installation directories when performing scheduled deep scans or updating signature definitions, mimicking the behavior of a Chinese hacktool.