originbotnet | 2e2112dfaed2fb60f86a66f02be3ab8bdba35e174e9d7e0c1e89d4f265cb23d1

General

Target

SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe
Size

541KB
MD5

edbe2f8eda4005da44e877b8c2c99163
SHA1

09a8769cc7537dc7cde52c2747364fb17cac5fe8
SHA256

2e2112dfaed2fb60f86a66f02be3ab8bdba35e174e9d7e0c1e89d4f265cb23d1
SHA512

f733171e0b720a635d60a1fca7700d1384ca98095a70edbbc9e0e5b1bb4e34c28066fe50051d1e7013cf8248091ec2e8dfad2ac30636d81825e59d492f234aa8
SSDEEP

1536:VxH/84RBumqgiBxcSZgFj5zlNc+ZYo7/rfOTNcmltpsXnRCHlTigBVrFuOL5aZc0:fEvgiTcSsO4Yo7jfYLtp0yluOLb

Score

10^/10

originbotnet keylogger rat trojan

Malware Config

Extracted

Family

originbotnet

C2

https://nitrosoftwares.shop/gate

Attributes

add_startup
false
download_folder_name
4yyaqgto.m0g
hide_file_startup
false
startup_directory_name
hhlquS
startup_environment_name
appdata
startup_installation_name
hhlquS.exe
startup_registry_name
hhlquS
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Signatures

OriginBotnet
OriginBotnet is a remote access trojan written in C#.
trojan rat keylogger originbotnet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4100 set thread context of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3528	1944	WerFault.exe	99

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1944	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe
1944	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1944	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1944	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	99
PID 4100 wrote to memory of 1596	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	100
PID 4100 wrote to memory of 1596	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	100
PID 4100 wrote to memory of 1596	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	100
PID 4100 wrote to memory of 1936	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	102
PID 4100 wrote to memory of 1936	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	102
PID 4100 wrote to memory of 1936	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	102
PID 4100 wrote to memory of 3356	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	101
PID 4100 wrote to memory of 3356	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	101
PID 4100 wrote to memory of 3356	4100	SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe	101
PID 1936 wrote to memory of 4844	1936	cmd.exe	106
PID 1936 wrote to memory of 4844	1936	cmd.exe	106
PID 1936 wrote to memory of 4844	1936	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1944
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 1996
    3⤵
    - Program crash
    PID:3528
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"
  2⤵
  PID:1596
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"
  2⤵
  PID:3356
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f
    3⤵
    - Creates scheduled task(s)
    PID:4844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1944 -ip 1944
1⤵
PID:1876

C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
C:\Users\Admin\AppData\Roaming\svchost\svchost.exe
1⤵
PID:4172

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

Filesize
541KB

MD5
edbe2f8eda4005da44e877b8c2c99163

SHA1
09a8769cc7537dc7cde52c2747364fb17cac5fe8

SHA256
2e2112dfaed2fb60f86a66f02be3ab8bdba35e174e9d7e0c1e89d4f265cb23d1

SHA512
f733171e0b720a635d60a1fca7700d1384ca98095a70edbbc9e0e5b1bb4e34c28066fe50051d1e7013cf8248091ec2e8dfad2ac30636d81825e59d492f234aa8

Download Submit
C:\Users\Admin\AppData\Roaming\svchost\svchost.exe

Filesize
541KB

MD5
edbe2f8eda4005da44e877b8c2c99163

SHA1
09a8769cc7537dc7cde52c2747364fb17cac5fe8

SHA256
2e2112dfaed2fb60f86a66f02be3ab8bdba35e174e9d7e0c1e89d4f265cb23d1

SHA512
f733171e0b720a635d60a1fca7700d1384ca98095a70edbbc9e0e5b1bb4e34c28066fe50051d1e7013cf8248091ec2e8dfad2ac30636d81825e59d492f234aa8

Download Submit
memory/1944-18-0x0000000007040000-0x0000000007202000-memory.dmp

Filesize
1.8MB

Download
memory/1944-16-0x0000000006E50000-0x0000000006E5A000-memory.dmp

Filesize
40KB

Download
memory/1944-21-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1944-20-0x0000000002F40000-0x0000000002F50000-memory.dmp

Filesize
64KB

Download
memory/1944-19-0x0000000007740000-0x0000000007C6C000-memory.dmp

Filesize
5.2MB

Download
memory/1944-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1944-9-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1944-17-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/1944-13-0x0000000002F40000-0x0000000002F50000-memory.dmp

Filesize
64KB

Download
memory/1944-14-0x0000000005570000-0x00000000055D6000-memory.dmp

Filesize
408KB

Download
memory/1944-15-0x0000000006950000-0x00000000069E2000-memory.dmp

Filesize
584KB

Download
memory/4100-3-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/4100-10-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4100-1-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4100-6-0x0000000000DA0000-0x0000000000DAC000-memory.dmp

Filesize
48KB

Download
memory/4100-5-0x00000000055E0000-0x00000000055F0000-memory.dmp

Filesize
64KB

Download
memory/4100-4-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4100-2-0x0000000005BA0000-0x0000000006144000-memory.dmp

Filesize
5.6MB

Download
memory/4100-0-0x0000000000C50000-0x0000000000CDE000-memory.dmp

Filesize
568KB

Download
memory/4172-24-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download
memory/4172-25-0x0000000074600000-0x0000000074DB0000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads