originbotnet | d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d

Analysis

max time kernel
153s
max time network
164s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12/10/2023, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ify.exe
Size

444KB
MD5

ff3f7420912be4a76765d062afe35522
SHA1

64e990dcdc497ee4c75b01142abcd358ecee7aae
SHA256

d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d
SHA512

ae85e0f606930468f81816014a93090576528e732624c911b126dbbcf3329ed1b122441e25108d91d44b0ee753c93905561c0c8683c74204875d6de1f65a531b
SSDEEP

6144:/TWnLxZdS7ykdyV31ctsDsWb93sVqndWR2j5lEFdcdx4PyrYWf5p49MV0Bsim4NL:/mNPYyVFaWaVqnQ8lnwyrYWf5TTn+D

Score

10^/10

originbotnet keylogger persistence rat trojan

Malware Config

Extracted

Family

originbotnet

http://yingxnimetals.com/gate

Attributes

add_startup
true
download_folder_name
x5wsbycp.epf
hide_file_startup
true
startup_directory_name
snuXV
startup_environment_name
appdata
startup_installation_name
snuXV.exe
startup_registry_name
snuXV
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Signatures

OriginBotnet
OriginBotnet is a remote access trojan written in C#.
trojan rat keylogger originbotnet

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3185155662-718608226-894467740-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Roaming\\snuXV\\snuXV.exe"	ify.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2260 set thread context of 2444	2260	ify.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2444	ify.exe
2444	ify.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2260	ify.exe
Token: SeDebugPrivilege	2444	ify.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30
PID 2260 wrote to memory of 2444	2260	ify.exe	30

C:\Users\Admin\AppData\Local\Temp\ify.exe
"C:\Users\Admin\AppData\Local\Temp\ify.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Users\Admin\AppData\Local\Temp\ify.exe
  "C:\Users\Admin\AppData\Local\Temp\ify.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2260-0-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2260-1-0x0000000000B40000-0x0000000000BB6000-memory.dmp

Filesize
472KB

Download
memory/2260-2-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2260-3-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/2260-4-0x0000000004E70000-0x0000000004EB0000-memory.dmp

Filesize
256KB

Download
memory/2260-5-0x00000000003C0000-0x00000000003D2000-memory.dmp

Filesize
72KB

Download
memory/2260-6-0x0000000000430000-0x0000000000438000-memory.dmp

Filesize
32KB

Download
memory/2260-7-0x0000000000440000-0x000000000044A000-memory.dmp

Filesize
40KB

Download
memory/2260-8-0x0000000002270000-0x00000000022B8000-memory.dmp

Filesize
288KB

Download
memory/2260-21-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2444-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2444-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2444-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2444-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2444-15-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2444-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2444-19-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2444-20-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download
memory/2444-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2444-22-0x0000000004B10000-0x0000000004B50000-memory.dmp

Filesize
256KB

Download
memory/2444-23-0x0000000073FD0000-0x00000000746BE000-memory.dmp

Filesize
6.9MB

Download