Analysis
- max time kernel
127s - max time network
123s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
14/10/2023, 10:49
General
- Target SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe
- Size 542KB
- Sample231014-mwwrmacf2x
- SHA256 9349ee0572a4968cf3270cc6d8505e314ec98706b2de10dc1417b3b6197b7c4f
Malware Config
Extracted
-
originbotnet
-
https://nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
jr3qf214.fmt
-
hide_file_startup
false
-
startup_directory_name
MrmassY
-
startup_environment_name
appdata
-
startup_installation_name
MrmassY.exe
-
startup_registry_name
MrmassY
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 29 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {41622FA1-CD5D-4BD9-9D11-67D41D1AF62C} S-1-5-21-686452656-3203474025-4140627569-1000:UUVOHKNL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
svchost.exe
memory/1196-35-0x00000000743D0000-0x0000000074ABE000-memory.dmp
memory/1196-38-0x0000000004840000-0x0000000004880000-memory.dmp
memory/1196-37-0x00000000743D0000-0x0000000074ABE000-memory.dmp
memory/1196-36-0x0000000004840000-0x0000000004880000-memory.dmp
memory/1196-34-0x0000000000C00000-0x0000000000C8E000-memory.dmp
memory/2108-3-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2108-4-0x0000000004820000-0x0000000004860000-memory.dmp
memory/2108-5-0x00000000003A0000-0x00000000003AC000-memory.dmp
memory/2108-27-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2108-2-0x0000000004820000-0x0000000004860000-memory.dmp
memory/2108-0-0x00000000001D0000-0x000000000025E000-memory.dmp
memory/2108-1-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2760-18-0x0000000000080000-0x000000000008E000-memory.dmp
memory/2760-26-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2760-25-0x0000000000080000-0x000000000008E000-memory.dmp
memory/2760-30-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2760-31-0x0000000074420000-0x0000000074B0E000-memory.dmp
memory/2760-22-0x0000000000080000-0x000000000008E000-memory.dmp
memory/2760-17-0x0000000000080000-0x000000000008E000-memory.dmp
memory/2760-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2760-12-0x0000000000080000-0x000000000008E000-memory.dmp
memory/2760-8-0x0000000000080000-0x000000000008E000-memory.dmp
memory/2760-10-0x0000000000080000-0x000000000008E000-memory.dmp
memory/2760-6-0x0000000000080000-0x000000000008E000-memory.dmp