originbotnet | d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d

Analysis

max time kernel
150s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ify.exe
Size

444KB
MD5

ff3f7420912be4a76765d062afe35522
SHA1

64e990dcdc497ee4c75b01142abcd358ecee7aae
SHA256

d555867e166d1e48bf13bc517f17565681c4a6ffdfde2a5eb9041b00b9164d8d
SHA512

ae85e0f606930468f81816014a93090576528e732624c911b126dbbcf3329ed1b122441e25108d91d44b0ee753c93905561c0c8683c74204875d6de1f65a531b
SSDEEP

6144:/TWnLxZdS7ykdyV31ctsDsWb93sVqndWR2j5lEFdcdx4PyrYWf5p49MV0Bsim4NL:/mNPYyVFaWaVqnQ8lnwyrYWf5TTn+D

Score

10^/10

originbotnet keylogger rat trojan

Malware Config

Extracted

Family

originbotnet

http://yingxnimetals.com/gate

Attributes

add_startup
true
download_folder_name
x5wsbycp.epf
hide_file_startup
true
startup_directory_name
snuXV
startup_environment_name
appdata
startup_installation_name
snuXV.exe
startup_registry_name
snuXV
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Signatures

OriginBotnet
OriginBotnet is a remote access trojan written in C#.
trojan rat keylogger originbotnet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2596 set thread context of 4792	2596	ify.exe	93

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	4792	WerFault.exe	93

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2596	ify.exe
2596	ify.exe
4792	ify.exe
4792	ify.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	ify.exe
Token: SeDebugPrivilege	4792	ify.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 4792	2596	ify.exe	93
PID 2596 wrote to memory of 4792	2596	ify.exe	93
PID 2596 wrote to memory of 4792	2596	ify.exe	93
PID 2596 wrote to memory of 4792	2596	ify.exe	93
PID 2596 wrote to memory of 4792	2596	ify.exe	93
PID 2596 wrote to memory of 4792	2596	ify.exe	93
PID 2596 wrote to memory of 4792	2596	ify.exe	93
PID 2596 wrote to memory of 4792	2596	ify.exe	93

C:\Users\Admin\AppData\Local\Temp\ify.exe
"C:\Users\Admin\AppData\Local\Temp\ify.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\ify.exe
  "C:\Users\Admin\AppData\Local\Temp\ify.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4792
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4792 -s 808
    3⤵
    - Program crash
    PID:2832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4792 -ip 4792
1⤵
PID:3940

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ify.exe.log

Filesize
1KB

MD5
8ec831f3e3a3f77e4a7b9cd32b48384c

SHA1
d83f09fd87c5bd86e045873c231c14836e76a05c

SHA256
7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

SHA512
26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

Download Submit
memory/2596-8-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/2596-10-0x0000000005930000-0x0000000005938000-memory.dmp

Filesize
32KB

Download
memory/2596-3-0x0000000005670000-0x0000000005702000-memory.dmp

Filesize
584KB

Download
memory/2596-4-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/2596-5-0x0000000005620000-0x000000000562A000-memory.dmp

Filesize
40KB

Download
memory/2596-6-0x0000000005940000-0x00000000059DC000-memory.dmp

Filesize
624KB

Download
memory/2596-7-0x0000000005880000-0x0000000005892000-memory.dmp

Filesize
72KB

Download
memory/2596-0-0x0000000000BA0000-0x0000000000C16000-memory.dmp

Filesize
472KB

Download
memory/2596-2-0x0000000005C20000-0x00000000061C4000-memory.dmp

Filesize
5.6MB

Download
memory/2596-11-0x0000000005B60000-0x0000000005B6A000-memory.dmp

Filesize
40KB

Download
memory/2596-9-0x00000000055C0000-0x00000000055D0000-memory.dmp

Filesize
64KB

Download
memory/2596-12-0x00000000071E0000-0x0000000007228000-memory.dmp

Filesize
288KB

Download
memory/2596-17-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/2596-1-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/4792-16-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download
memory/4792-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4792-18-0x00000000751A0000-0x0000000075950000-memory.dmp

Filesize
7.7MB

Download