Analysis
- max time kernel
150s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
12/10/2023, 17:26
General
- Target ify.exe
- Size 444KB
- Sample231012-v1ctbagc86
- SHA256 d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d
Malware Config
Extracted
-
originbotnet
-
http://yingxnimetals.com/gate
-
add_startup
true
-
download_folder_name
x5wsbycp.epf
-
hide_file_startup
true
-
startup_directory_name
snuXV
-
startup_environment_name
appdata
-
startup_installation_name
snuXV.exe
-
startup_registry_name
snuXV
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ify.exe"C:\Users\Admin\AppData\Local\Temp\ify.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ify.exe"C:\Users\Admin\AppData\Local\Temp\ify.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 8083⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4792 -ip 47921⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
ify.exe.log
memory/2596-8-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2596-10-0x0000000005930000-0x0000000005938000-memory.dmp
memory/2596-3-0x0000000005670000-0x0000000005702000-memory.dmp
memory/2596-4-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/2596-5-0x0000000005620000-0x000000000562A000-memory.dmp
memory/2596-6-0x0000000005940000-0x00000000059DC000-memory.dmp
memory/2596-7-0x0000000005880000-0x0000000005892000-memory.dmp
memory/2596-0-0x0000000000BA0000-0x0000000000C16000-memory.dmp
memory/2596-2-0x0000000005C20000-0x00000000061C4000-memory.dmp
memory/2596-11-0x0000000005B60000-0x0000000005B6A000-memory.dmp
memory/2596-9-0x00000000055C0000-0x00000000055D0000-memory.dmp
memory/2596-12-0x00000000071E0000-0x0000000007228000-memory.dmp
memory/2596-17-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/2596-1-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/4792-16-0x00000000751A0000-0x0000000075950000-memory.dmp
memory/4792-13-0x0000000000400000-0x000000000040E000-memory.dmp
memory/4792-18-0x00000000751A0000-0x0000000075950000-memory.dmp