Chinese Hacktool Set - file Down64.exe

Hunt Hypothesis

This hunt targets adversaries deploying the specific “Down64.exe” component of a Chinese hacktool suite to establish persistence or execute reconnaissance within the environment. Proactively hunting for this artifact in Azure Sentinel is critical because its presence may indicate early-stage lateral movement by a state-sponsored threat actor that standard low-severity alerts might otherwise overlook.

YARA Rule

rule Dos_Down64 {
	meta:
		description = "Chinese Hacktool Set - file Down64.exe"
		author = "Florian Roth"
		reference = "http://tools.zjqhr.com/"
		date = "2015-06-13"
		hash = "43e455e43b49b953e17a5b885ffdcdf8b6b23226"
	strings:
		$s1 = "C:\\Windows\\Temp\\Down.txt" fullword wide
		$s2 = "C:\\Windows\\Temp\\Cmd.txt" fullword wide
		$s3 = "C:\\Windows\\Temp\\" fullword wide
		$s4 = "ProcessXElement" fullword ascii
		$s8 = "down.exe" fullword wide
		$s20 = "set_Timer1" fullword ascii
	condition:
		uint16(0) == 0x5a4d and filesize < 150KB and all of them
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 6 string patterns in its detection logic.

References

• http://tools.zjqhr.com/
• Source Rule

False Positive Guidance

Here are 5 specific false positive scenarios for the Chinese Hacktool Set - file Down64.exe detection rule, including suggested filters and exclusions:

• Scenario: Legitimate Software Deployment via SCCM/MECM

  • Context: The System Center Configuration Manager (SCCM) or Microsoft Endpoint Configuration Manager deploys a standard enterprise application package named Down64.exe to the C:\Program Files\Deployment\Staging directory. This file acts as a temporary installer wrapper for a third-party utility before extracting the main payload and deleting itself.
  • Suggested Filter: Create an exclusion based on the Parent Process being ccmexec.exe (the SCCM agent service) or smstshost.exe. Additionally, exclude file paths containing \SCCM\ or \Deployment\Staging\.

• Scenario: Scheduled Maintenance Job for Internal Reporting Tool

  • Context: An internal IT team runs a nightly scheduled task using Windows Task Scheduler to update local reporting dashboards. The job executes Down64.exe, which is actually a customized version of the “Download Manager” tool used by the organization’s Finance department to fetch daily CSV exports from an internal server.
  • Suggested Filter: Exclude executions where the Command Line arguments contain specific flags (e.g., -daily-report or --internal) and the file path is located within a known trusted directory, such as C:\ProgramData\InternalTools\Reporting\.

• Scenario: Endpoint Protection Definition Updates

  • Context: A third-party endpoint protection suite (e.g., CrowdStrike, SentinelOne, or a legacy Chinese AV solution like Kingsoft) utilizes Down64.exe as its background download service to fetch virus definition updates. This process runs frequently during off-peak hours and is signed by the vendor’s code