Analysis
- max time kernel
150s - max time network
157s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
11/05/2024, 01:54
General
- Target cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe
- Size 251KB
- Sample240511-cbm9mshd42
- SHA256 cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201
Malware Config
Extracted
-
originbotnet
-
https://mmelak.com/gate
-
add_startup
false
-
download_folder_name
4si50kud.vpv
-
hide_file_startup
false
-
startup_directory_name
pRcub
-
startup_environment_name
appdata
-
startup_installation_name
pRcub.exe
-
startup_registry_name
pRcub
-
user_agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Signatures
- OriginBotnet
OriginBotnet is a remote access trojan written in C#.
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe"C:\Users\Admin\AppData\Local\Temp\cf52051f68630359830c5b2d6c9b8ff3b6e95c5667238787f2972accc0bc0201.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dovhbys.exe"C:\Users\Admin\AppData\Local\Temp\dovhbys.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\dovhbys.exe"C:\Users\Admin\AppData\Local\Temp\dovhbys.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4152,i,6166776566165096562,4582328833313060853,262144 --variations-seed-version --mojo-platform-channel-handle=4124 /prefetch:81⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
dovhbys.exe
rdzgbm.x
memory/2200-17-0x0000000005610000-0x0000000005BB4000-memory.dmp
memory/2200-18-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/2200-10-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2200-12-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2200-13-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2200-14-0x000000007456E000-0x000000007456F000-memory.dmp
memory/2200-15-0x00000000028E0000-0x00000000028EE000-memory.dmp
memory/2200-16-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/2200-28-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/2200-8-0x0000000000400000-0x000000000041F000-memory.dmp
memory/2200-19-0x0000000004ED0000-0x0000000004F36000-memory.dmp
memory/2200-20-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/2200-21-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/2200-22-0x0000000006430000-0x00000000064C2000-memory.dmp
memory/2200-23-0x00000000065C0000-0x00000000065CA000-memory.dmp
memory/2200-24-0x00000000068A0000-0x0000000006A62000-memory.dmp
memory/2200-25-0x0000000006FA0000-0x00000000074CC000-memory.dmp
memory/2200-26-0x000000007456E000-0x000000007456F000-memory.dmp
memory/2200-27-0x0000000074560000-0x0000000074D10000-memory.dmp
memory/3540-5-0x0000000000F30000-0x0000000000F32000-memory.dmp