Analysis
- max time kernel
144s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
14/10/2023, 10:50
General
- Target docyo20230907.exe
- Size 400.0MB
- Sample231014-mxa7baef62
- SHA256 998e4dba4672aadfded633d9f4f728d640a563ead01145b00a7e67aad2f04f91
Malware Config
Extracted
-
originbotnet
-
https://nitrosoftwares.shop/gate
-
add_startup
false
-
download_folder_name
kzjfo5t0.k2j
-
hide_file_startup
false
-
startup_directory_name
IrIPdj
-
startup_environment_name
appdata
-
startup_installation_name
IrIPdj.exe
-
startup_registry_name
IrIPdj
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"C:\Users\Admin\AppData\Local\Temp\docyo20230907.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 14283⤵
- Program crash
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1932 -ip 19321⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1932-10-0x0000000006BE0000-0x0000000006C72000-memory.dmp
memory/1932-16-0x0000000074720000-0x0000000074ED0000-memory.dmp
memory/1932-15-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/1932-14-0x00000000079A0000-0x0000000007ECC000-memory.dmp
memory/1932-13-0x00000000072A0000-0x0000000007462000-memory.dmp
memory/1932-12-0x0000000074720000-0x0000000074ED0000-memory.dmp
memory/1932-6-0x0000000000400000-0x000000000040E000-memory.dmp
memory/1932-7-0x0000000074720000-0x0000000074ED0000-memory.dmp
memory/1932-11-0x0000000006F90000-0x0000000006F9A000-memory.dmp
memory/1932-9-0x00000000058D0000-0x00000000058E0000-memory.dmp
memory/2892-4-0x0000000004E40000-0x0000000004EA6000-memory.dmp
memory/2892-8-0x0000000074720000-0x0000000074ED0000-memory.dmp
memory/2892-5-0x0000000004E00000-0x0000000004E0C000-memory.dmp
memory/2892-0-0x0000000000400000-0x0000000000454000-memory.dmp
memory/2892-3-0x0000000004E30000-0x0000000004E40000-memory.dmp
memory/2892-2-0x00000000053F0000-0x0000000005994000-memory.dmp
memory/2892-1-0x0000000074720000-0x0000000074ED0000-memory.dmp