Analysis
- max time kernel
153s - max time network
164s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
12/10/2023, 17:26
General
- Target ify.exe
- Size 444KB
- Sample231012-v1ctbagc86
- SHA256 d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d
Malware Config
Extracted
-
originbotnet
-
http://yingxnimetals.com/gate
-
add_startup
true
-
download_folder_name
x5wsbycp.epf
-
hide_file_startup
true
-
startup_directory_name
snuXV
-
startup_environment_name
appdata
-
startup_installation_name
snuXV.exe
-
startup_registry_name
snuXV
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ify.exe"C:\Users\Admin\AppData\Local\Temp\ify.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ify.exe"C:\Users\Admin\AppData\Local\Temp\ify.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2260-0-0x0000000073FD0000-0x00000000746BE000-memory.dmp
memory/2260-1-0x0000000000B40000-0x0000000000BB6000-memory.dmp
memory/2260-2-0x0000000073FD0000-0x00000000746BE000-memory.dmp
memory/2260-3-0x0000000004E70000-0x0000000004EB0000-memory.dmp
memory/2260-4-0x0000000004E70000-0x0000000004EB0000-memory.dmp
memory/2260-5-0x00000000003C0000-0x00000000003D2000-memory.dmp
memory/2260-6-0x0000000000430000-0x0000000000438000-memory.dmp
memory/2260-7-0x0000000000440000-0x000000000044A000-memory.dmp
memory/2260-8-0x0000000002270000-0x00000000022B8000-memory.dmp
memory/2260-21-0x0000000073FD0000-0x00000000746BE000-memory.dmp
memory/2444-10-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2444-12-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2444-11-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2444-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2444-15-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2444-17-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2444-19-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2444-20-0x0000000073FD0000-0x00000000746BE000-memory.dmp
memory/2444-9-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2444-22-0x0000000004B10000-0x0000000004B50000-memory.dmp
memory/2444-23-0x0000000073FD0000-0x00000000746BE000-memory.dmp