originbotnet | 0c45c035d97ecfff230ad1e43e48fede7dfa12de465bedb69b75884e16bf2113

Analysis

max time kernel
152s
max time network
132s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

docrw20230914.exe
Size

699KB
MD5

e6f17e5433dcdd4ca662c8dbf32639db
SHA1

0ce524d7110e18fba4d45623813bc85bc52c3b67
SHA256

0c45c035d97ecfff230ad1e43e48fede7dfa12de465bedb69b75884e16bf2113
SHA512

6ac3b42fac3733ea486354baaf47294eef45021835c7c42a4a5ca95f0ccbdd71cddeccfdee2c1b6d4d9e8ea021f8660ca116f7fed3f58dc7fadcc5205be35aed
SSDEEP

12288:xP1loubhci5aaVy8vgwxMKhNxnZb7zmgMIQSGTFe8DKrUO:V1losyGaen9MkHZb7vQJTFen

Score

10^/10

originbotnet keylogger rat trojan

Malware Config

Extracted

Family

originbotnet

https://nitrosoftwares.shop/gate

Attributes

add_startup
false
download_folder_name
jr3qf214.fmt
hide_file_startup
false
startup_directory_name
MrmassY
startup_environment_name
appdata
startup_installation_name
MrmassY.exe
startup_registry_name
MrmassY
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Signatures

OriginBotnet
OriginBotnet is a remote access trojan written in C#.
trojan rat keylogger originbotnet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2080 set thread context of 3068	2080	docrw20230914.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	docrw20230914.exe
3068	docrw20230914.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	docrw20230914.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30
PID 2080 wrote to memory of 3068	2080	docrw20230914.exe	30

C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe
"C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe
  "C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2080-0-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-1-0x0000000000DB0000-0x0000000000E64000-memory.dmp

Filesize
720KB

Download
memory/2080-2-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download
memory/2080-3-0x00000000045E0000-0x0000000004620000-memory.dmp

Filesize
256KB

Download
memory/2080-4-0x00000000045E0000-0x0000000004620000-memory.dmp

Filesize
256KB

Download
memory/2080-5-0x0000000000940000-0x00000000009A0000-memory.dmp

Filesize
384KB

Download
memory/2080-23-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3068-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3068-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3068-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3068-16-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3068-18-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3068-20-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3068-21-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download
memory/3068-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3068-24-0x0000000074B70000-0x000000007525E000-memory.dmp

Filesize
6.9MB

Download