Analysis
- max time kernel
118s - max time network
136s - platform
windows7_x64 - resource
win7-20230831-en - resource tags
- submitted
14/10/2023, 10:50
General
- Target docyo20230907.exe
- Size 400.0MB
- Sample231014-mxa7baef62
- SHA256 998e4dba4672aadfded633d9f4f728d640a563ead01145b00a7e67aad2f04f91
Malware Config
Extracted
-
originbotnet
-
https://nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
kzjfo5t0.k2j
-
hide_file_startup
false
-
startup_directory_name
IrIPdj
-
startup_environment_name
appdata
-
startup_installation_name
IrIPdj.exe
-
startup_registry_name
IrIPdj
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\svchost"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1908-0-0x0000000000F80000-0x0000000000FD4000-memory.dmp
memory/1908-1-0x0000000074230000-0x000000007491E000-memory.dmp
memory/1908-2-0x0000000004850000-0x0000000004890000-memory.dmp
memory/1908-3-0x0000000000330000-0x000000000033C000-memory.dmp
memory/1908-16-0x0000000074230000-0x000000007491E000-memory.dmp
memory/2136-8-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2136-6-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2136-7-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2136-5-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2136-10-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2136-12-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2136-14-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2136-15-0x0000000074230000-0x000000007491E000-memory.dmp
memory/2136-4-0x0000000000400000-0x000000000040E000-memory.dmp
memory/2136-17-0x0000000004C20000-0x0000000004C60000-memory.dmp
memory/2136-18-0x0000000074230000-0x000000007491E000-memory.dmp
memory/2136-19-0x0000000074230000-0x000000007491E000-memory.dmp