Analysis
- max time kernel
119s - max time network
122s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
14/10/2023, 10:49
General
- Target SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe
- Size 268KB
- Sample231014-mww3dscf21
- SHA256 b68d46be4a85016270a6cb5d11295225ae4fab655eada32344422edad43c155b
Malware Config
Extracted
-
originbotnet
-
https://joshua6440.nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
jfede1fc.mke
-
hide_file_startup
false
-
startup_directory_name
MnNshND
-
startup_environment_name
appdata
-
startup_installation_name
MnNshND.exe
-
startup_registry_name
MnNshND
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1788-17-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1788-15-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1788-24-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/1788-23-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/1788-22-0x0000000004A00000-0x0000000004A40000-memory.dmp
memory/1788-5-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1788-7-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1788-9-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1788-20-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/1788-11-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1788-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/1788-19-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2124-0-0x0000000000990000-0x00000000009D8000-memory.dmp
memory/2124-1-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2124-21-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2124-4-0x0000000000410000-0x000000000041C000-memory.dmp
memory/2124-3-0x0000000074560000-0x0000000074C4E000-memory.dmp
memory/2124-2-0x0000000004AD0000-0x0000000004B10000-memory.dmp