originbotnet | 29088b8d5480560b4adbbd65b411e32722363bcbdf0c7e1a7ba182fd9d11d25c

Analysis

max time kernel
76s
max time network
124s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
14/10/2023, 10:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe
Size

267KB
MD5

ab928fbd4830f07cf7ac488dca1e746d
SHA1

1ae67cf7561616b8543b83c850b93b1952824be7
SHA256

29088b8d5480560b4adbbd65b411e32722363bcbdf0c7e1a7ba182fd9d11d25c
SHA512

3c3e39811b9b0a50235c7a6aec97fa7d6ebcf1afa02ccc89b484aa7b5d13c1aa85d4518c37743843c6bf95aee83e0efd723d62e38f8a0d0bb879cad457b03cf4
SSDEEP

3072:8uvgD6S2+qU3kNAwGE84AsQvnlBrII/J+M:8uvU2gKAwGE84bQ/ly

Score

10^/10

originbotnet keylogger rat trojan

Malware Config

Extracted

Family

originbotnet

https://nitrosoftwares.shop/gate

Attributes

add_startup
false
download_folder_name
0uvf4vxi.zxu
hide_file_startup
false
startup_directory_name
VxxWqfE
startup_environment_name
appdata
startup_installation_name
VxxWqfE.exe
startup_registry_name
VxxWqfE
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0

Signatures

OriginBotnet
OriginBotnet is a remote access trojan written in C#.
trojan rat keylogger originbotnet

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1988 set thread context of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2476	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe
2476	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2476	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2476	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	30
PID 1988 wrote to memory of 2484	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	31
PID 1988 wrote to memory of 2484	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	31
PID 1988 wrote to memory of 2484	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	31
PID 1988 wrote to memory of 2484	1988	SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe	31

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.12255.26012.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2476
- C:\Windows\SysWOW64\cmd.exe
  "cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"
  2⤵
  PID:2484

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1988-0-0x0000000000800000-0x0000000000848000-memory.dmp

Filesize
288KB

Download
memory/1988-1-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-2-0x0000000004950000-0x0000000004990000-memory.dmp

Filesize
256KB

Download
memory/1988-3-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/1988-4-0x0000000000370000-0x000000000037C000-memory.dmp

Filesize
48KB

Download
memory/1988-17-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/2476-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2476-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2476-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2476-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2476-15-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2476-13-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2476-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2476-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2476-16-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/2476-18-0x0000000000900000-0x0000000000940000-memory.dmp

Filesize
256KB

Download
memory/2476-19-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download
memory/2476-20-0x0000000000900000-0x0000000000940000-memory.dmp

Filesize
256KB

Download
memory/2476-21-0x00000000740D0000-0x00000000747BE000-memory.dmp

Filesize
6.9MB

Download