Analysis
- max time kernel
76s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
14/10/2023, 10:49
General
- Target SecuriteInfo.com.Win32.RATX-gen.23117.32662.exe
- Size 542KB
- Sample231014-mww3dscf2z
- SHA256 4f09e1857f411cee21a8f8b56535dcf67937ec013873c180215c6420856b4e17
Malware Config
Extracted
-
originbotnet
-
https://lamba.nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
zeyy4dqc.kds
-
hide_file_startup
false
-
startup_directory_name
efUDQ
-
startup_environment_name
appdata
-
startup_installation_name
efUDQ.exe
-
startup_registry_name
efUDQ
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.23117.32662.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.23117.32662.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.23117.32662.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.23117.32662.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 13643⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.23117.32662.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f1⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 5000 -ip 50001⤵
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
svchost.exe
memory/1324-26-0x0000000075070000-0x0000000075820000-memory.dmp
memory/1324-25-0x0000000075070000-0x0000000075820000-memory.dmp
memory/1336-1-0x0000000075070000-0x0000000075820000-memory.dmp
memory/1336-2-0x0000000005480000-0x0000000005A24000-memory.dmp
memory/1336-3-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/1336-4-0x0000000075070000-0x0000000075820000-memory.dmp
memory/1336-5-0x0000000004EC0000-0x0000000004ED0000-memory.dmp
memory/1336-6-0x0000000000C20000-0x0000000000C2C000-memory.dmp
memory/1336-11-0x0000000075070000-0x0000000075820000-memory.dmp
memory/1336-0-0x0000000000550000-0x00000000005DE000-memory.dmp
memory/5000-14-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/5000-17-0x00000000065D0000-0x00000000065DA000-memory.dmp
memory/5000-18-0x0000000075070000-0x0000000075820000-memory.dmp
memory/5000-19-0x00000000067C0000-0x0000000006982000-memory.dmp
memory/5000-20-0x0000000006EC0000-0x00000000073EC000-memory.dmp
memory/5000-21-0x0000000004DE0000-0x0000000004DF0000-memory.dmp
memory/5000-22-0x0000000075070000-0x0000000075820000-memory.dmp
memory/5000-16-0x00000000060F0000-0x0000000006182000-memory.dmp
memory/5000-15-0x0000000004D50000-0x0000000004DB6000-memory.dmp
memory/5000-9-0x00000000003F0000-0x00000000003FE000-memory.dmp
memory/5000-10-0x0000000075070000-0x0000000075820000-memory.dmp