Analysis
- max time kernel
78s - max time network
146s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
14/10/2023, 10:49
General
- Target SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe
- Size 541KB
- Sample231014-mwwrmacf2y
- SHA256 2e2112dfaed2fb60f86a66f02be3ab8bdba35e174e9d7e0c1e89d4f265cb23d1
Malware Config
Extracted
-
originbotnet
-
https://nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
4yyaqgto.m0g
-
hide_file_startup
false
-
startup_directory_name
hhlquS
-
startup_environment_name
appdata
-
startup_installation_name
hhlquS.exe
-
startup_registry_name
hhlquS
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1944 -s 19963⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.5586.24858.exe" "C:\Users\Admin\AppData\Roaming\svchost\svchost.exe"2⤵
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\svchost\svchost.exe'" /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1944 -ip 19441⤵
-
C:\Users\Admin\AppData\Roaming\svchost\svchost.exeC:\Users\Admin\AppData\Roaming\svchost\svchost.exe1⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
svchost.exe
memory/1944-18-0x0000000007040000-0x0000000007202000-memory.dmp
memory/1944-16-0x0000000006E50000-0x0000000006E5A000-memory.dmp
memory/1944-21-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/1944-20-0x0000000002F40000-0x0000000002F50000-memory.dmp
memory/1944-19-0x0000000007740000-0x0000000007C6C000-memory.dmp
memory/1944-7-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1944-9-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/1944-17-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/1944-13-0x0000000002F40000-0x0000000002F50000-memory.dmp
memory/1944-14-0x0000000005570000-0x00000000055D6000-memory.dmp
memory/1944-15-0x0000000006950000-0x00000000069E2000-memory.dmp
memory/4100-3-0x00000000055E0000-0x00000000055F0000-memory.dmp
memory/4100-10-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/4100-1-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/4100-6-0x0000000000DA0000-0x0000000000DAC000-memory.dmp
memory/4100-5-0x00000000055E0000-0x00000000055F0000-memory.dmp
memory/4100-4-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/4100-2-0x0000000005BA0000-0x0000000006144000-memory.dmp
memory/4100-0-0x0000000000C50000-0x0000000000CDE000-memory.dmp
memory/4172-24-0x0000000074600000-0x0000000074DB0000-memory.dmp
memory/4172-25-0x0000000074600000-0x0000000074DB0000-memory.dmp