originbotnet | 0c45c035d97ecfff230ad1e43e48fede7dfa12de465bedb69b75884e16bf2113

Analysis

max time kernel
155s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14/10/2023, 01:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

docrw20230914.exe
Size

699KB
MD5

e6f17e5433dcdd4ca662c8dbf32639db
SHA1

0ce524d7110e18fba4d45623813bc85bc52c3b67
SHA256

0c45c035d97ecfff230ad1e43e48fede7dfa12de465bedb69b75884e16bf2113
SHA512

6ac3b42fac3733ea486354baaf47294eef45021835c7c42a4a5ca95f0ccbdd71cddeccfdee2c1b6d4d9e8ea021f8660ca116f7fed3f58dc7fadcc5205be35aed
SSDEEP

12288:xP1loubhci5aaVy8vgwxMKhNxnZb7zmgMIQSGTFe8DKrUO:V1losyGaen9MkHZb7vQJTFen

Score

10^/10

originbotnet keylogger rat trojan

Malware Config

Extracted

Family

originbotnet

https://nitrosoftwares.shop/gate

Attributes

add_startup
false
download_folder_name
jr3qf214.fmt
hide_file_startup
false
startup_directory_name
MrmassY
startup_environment_name
appdata
startup_installation_name
MrmassY.exe
startup_registry_name
MrmassY
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Signatures

OriginBotnet
OriginBotnet is a remote access trojan written in C#.
trojan rat keylogger originbotnet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3388 set thread context of 4100	3388	docrw20230914.exe	99

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2632	4100	WerFault.exe	99

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4100	docrw20230914.exe
4100	docrw20230914.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	docrw20230914.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99
PID 3388 wrote to memory of 4100	3388	docrw20230914.exe	99

C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe
"C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe
  "C:\Users\Admin\AppData\Local\Temp\docrw20230914.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4100 -s 1384
    3⤵
    - Program crash
    PID:2632

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4100 -ip 4100
1⤵
PID:2720

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3388-0-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/3388-1-0x00000000007C0000-0x0000000000874000-memory.dmp

Filesize
720KB

Download
memory/3388-2-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/3388-3-0x0000000005890000-0x0000000005E34000-memory.dmp

Filesize
5.6MB

Download
memory/3388-4-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/3388-5-0x00000000052D0000-0x00000000052E0000-memory.dmp

Filesize
64KB

Download
memory/3388-6-0x0000000000FB0000-0x0000000001010000-memory.dmp

Filesize
384KB

Download
memory/3388-10-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/4100-8-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download
memory/4100-7-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/4100-11-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4100-12-0x0000000004FC0000-0x0000000005026000-memory.dmp

Filesize
408KB

Download
memory/4100-13-0x0000000075100000-0x00000000758B0000-memory.dmp

Filesize
7.7MB

Download
memory/4100-14-0x00000000062A0000-0x0000000006332000-memory.dmp

Filesize
584KB

Download
memory/4100-15-0x00000000050A0000-0x00000000050B0000-memory.dmp

Filesize
64KB

Download
memory/4100-16-0x0000000006790000-0x000000000679A000-memory.dmp

Filesize
40KB

Download
memory/4100-17-0x0000000006990000-0x0000000006B52000-memory.dmp

Filesize
1.8MB

Download
memory/4100-18-0x0000000007090000-0x00000000075BC000-memory.dmp

Filesize
5.2MB

Download