Analysis
- max time kernel
167s - max time network
164s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
14/10/2023, 10:49
General
- Target SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe
- Size 542KB
- Sample231014-mwwrmacf2x
- SHA256 9349ee0572a4968cf3270cc6d8505e314ec98706b2de10dc1417b3b6197b7c4f
Malware Config
Extracted
-
originbotnet
-
https://nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
jr3qf214.fmt
-
hide_file_startup
false
-
startup_directory_name
MrmassY
-
startup_environment_name
appdata
-
startup_installation_name
MrmassY.exe
-
startup_registry_name
MrmassY
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Executes dropped EXE 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3612 -s 8163⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.8034.27212.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3612 -ip 36121⤵
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
svchost.exe
memory/2516-17-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/2516-16-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/3612-7-0x0000000000400000-0x000000000040E000-memory.dmp
memory/3612-13-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/3612-9-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4408-6-0x0000000001290000-0x000000000129C000-memory.dmp
memory/4408-1-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4408-10-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4408-5-0x0000000002FA0000-0x0000000002FB0000-memory.dmp
memory/4408-4-0x00000000749C0000-0x0000000075170000-memory.dmp
memory/4408-3-0x0000000002FA0000-0x0000000002FB0000-memory.dmp
memory/4408-2-0x0000000005BC0000-0x0000000006164000-memory.dmp
memory/4408-0-0x0000000000CC0000-0x0000000000D4E000-memory.dmp