originbotnet | b68d46be4a85016270a6cb5d11295225ae4fab655eada32344422edad43c155b

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe
Size

268KB
MD5

eac56810ae04fc2704b1b89559841ee3
SHA1

bbc1dad3bf50eb73a7dbb429ed4bb7016b860968
SHA256

b68d46be4a85016270a6cb5d11295225ae4fab655eada32344422edad43c155b
SHA512

86f1eb3164669f1a70944e17f29cc419e8d76ae3351665527af7e3f513b44a0e6ae2555bb3b869fd20b310c7de8e45480106e9483e72eb7a9c02f3167f1d25bb
SSDEEP

1536:c9H/84RBumqgVp+INHZs5zv2RHtPO19HRYkw+Uo4V8cv/SxDmjLg2BrIGd99XZGY:yEvgVHNHTRNPgRX1SvnlBrII/J+M

Score

10^/10

originbotnet keylogger rat trojan

Malware Config

Extracted

Family

originbotnet

https://joshua6440.nitrosoftwares.shop/gate

Attributes

add_startup
false
download_folder_name
jfede1fc.mke
hide_file_startup
false
startup_directory_name
MnNshND
startup_environment_name
appdata
startup_installation_name
MnNshND.exe
startup_registry_name
MnNshND
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Signatures

OriginBotnet
OriginBotnet is a remote access trojan written in C#.
trojan rat keylogger originbotnet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1788	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe
1788	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30
PID 2124 wrote to memory of 1788	2124	SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe	30

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.30771.2599.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1788
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"
  2⤵
  PID:2680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1788-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1788-15-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1788-24-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-23-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-22-0x0000000004A00000-0x0000000004A40000-memory.dmp

Filesize
256KB

Download
memory/1788-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1788-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1788-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1788-20-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/1788-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1788-13-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1788-19-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2124-0-0x0000000000990000-0x00000000009D8000-memory.dmp

Filesize
288KB

Download
memory/2124-1-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-21-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-4-0x0000000000410000-0x000000000041C000-memory.dmp

Filesize
48KB

Download
memory/2124-3-0x0000000074560000-0x0000000074C4E000-memory.dmp

Filesize
6.9MB

Download
memory/2124-2-0x0000000004AD0000-0x0000000004B10000-memory.dmp

Filesize
256KB

Download