Analysis
-
max time kernel
132s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-05-2022 02:41
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.13966.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.13966.exe
-
Size
589KB
-
MD5
bc73f146c5f10a875ba645b7c9b567bd
-
SHA1
e65a9edc4bf551c9eb0f75e813980c3d96966203
-
SHA256
d4d430cfe4399aa57154854567d17ef118b6d0eee083b683f81957d2057949b0
-
SHA512
8a9468f68e6d752409c64da0acd990b2d742a1862744c6c248eb1c01a75791dc76f0f33c28d2889beb46c745087d0754aa8e645243f3924f14b2dd4baa7f6370
Malware Config
Extracted
formbook
4.1
t19g
playstationspiele.com
cakesbyannal.com
racepin.space
anti-offender.com
magnetque.com
farragorealtybrokerage.com
khuludmohammed.com
v33696.com
84ggg.com
d440.com
soccersmarthome.com
ofthis.world
fivestaryardcards.com
lusyard.com
gghft.com
viajesfortur.com
rationalirrationality.com
hanaramenrestaurant.com
exactlycleanse.com
martensenargentina.com
michellesellsvt.com
pupsloveandlondon.com
kfhym.world
makeuphoje.com
ebookrise.com
flesherbrothers.com
doonaudio.com
doanet.xyz
wrghintlian.com
davidchristl.com
domaintch.com
quotereflection.com
eroptikblog.xyz
iranianinvestmentclub.com
cp200motorola.com
vsenq.com
theamazonmovement.com
aspiteksoln.com
perkebunannews.com
myreverie.life
hrddf.com
gblaincreative.com
lipsstreet.com
xxf76.top
dureluxx.com
heldelicioso.com
taskconsulting.com
dongcunzhengfu.com
itohpe.com
abundantskill.com
fernhutco.com
hairgrowthxpert.com
intelligentreportscloud.com
maybesupply.com
7156.world
cr-marcelo.com
shequipamentos.com
villeenvie.net
robbyscreations.com
mpaohead.com
nailsa.biz
accoladesandmore.com
preppers.pro
pinpinduo2.xyz
allsofttech.com
Signatures
-
Formbook Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1316-85-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1316-86-0x000000000041F1B0-mapping.dmp formbook -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.13966.exedescription pid process target process PID 1984 set thread context of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exeSecuriteInfo.com.W32.AIDetectNet.01.13966.exeSecuriteInfo.com.W32.AIDetectNet.01.13966.exepid process 2004 powershell.exe 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe 1316 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exeSecuriteInfo.com.W32.AIDetectNet.01.13966.exedescription pid process Token: SeDebugPrivilege 2004 powershell.exe Token: SeDebugPrivilege 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.13966.exedescription pid process target process PID 1984 wrote to memory of 2004 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe powershell.exe PID 1984 wrote to memory of 2004 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe powershell.exe PID 1984 wrote to memory of 2004 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe powershell.exe PID 1984 wrote to memory of 2004 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe powershell.exe PID 1984 wrote to memory of 1320 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe schtasks.exe PID 1984 wrote to memory of 1320 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe schtasks.exe PID 1984 wrote to memory of 1320 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe schtasks.exe PID 1984 wrote to memory of 1320 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe schtasks.exe PID 1984 wrote to memory of 1356 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1356 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1356 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1356 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 304 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 304 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 304 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 304 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe PID 1984 wrote to memory of 1316 1984 SecuriteInfo.com.W32.AIDetectNet.01.13966.exe SecuriteInfo.com.W32.AIDetectNet.01.13966.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dkgzVkqRcsr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dkgzVkqRcsr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB1A4.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.13966.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB1A4.tmpFilesize
1KB
MD589981c73029956500729829db4e1ed71
SHA1f439314b5ba34c6fe3a2916d01ac61f6db3f6c0c
SHA256a576c9348331439d88c9cd1a0e84496767d3fc346abcdd35d3be04bfd54c55e0
SHA512655a97aac8ff1110538221c82e9560f8a2452495e4380824eff0afc0c1e954cabc9c0ced184d20fcddfbad98db28ff09fce013c695755fa69a00a07456e0d0c2
-
memory/1316-93-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/1316-86-0x000000000041F1B0-mapping.dmp
-
memory/1316-85-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-83-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1316-82-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1320-71-0x0000000000000000-mapping.dmp
-
memory/1984-68-0x00000000702A0000-0x0000000070471000-memory.dmpFilesize
1.8MB
-
memory/1984-89-0x0000000074850000-0x00000000749E4000-memory.dmpFilesize
1.6MB
-
memory/1984-63-0x00000000004A0000-0x00000000004B6000-memory.dmpFilesize
88KB
-
memory/1984-64-0x0000000072C00000-0x0000000073F8F000-memory.dmpFilesize
19.6MB
-
memory/1984-65-0x00000000721F0000-0x0000000072C00000-memory.dmpFilesize
10.1MB
-
memory/1984-66-0x0000000074850000-0x00000000749E4000-memory.dmpFilesize
1.6MB
-
memory/1984-67-0x00000000714D0000-0x00000000721ED000-memory.dmpFilesize
13.1MB
-
memory/1984-54-0x0000000000190000-0x0000000000228000-memory.dmpFilesize
608KB
-
memory/1984-69-0x0000000005B90000-0x0000000005C22000-memory.dmpFilesize
584KB
-
memory/1984-55-0x00000000765C1000-0x00000000765C3000-memory.dmpFilesize
8KB
-
memory/1984-61-0x0000000074750000-0x000000007484C000-memory.dmpFilesize
1008KB
-
memory/1984-60-0x0000000070CF0000-0x00000000714D0000-memory.dmpFilesize
7.9MB
-
memory/1984-74-0x0000000070170000-0x0000000070293000-memory.dmpFilesize
1.1MB
-
memory/1984-75-0x00000000702A0000-0x0000000070471000-memory.dmpFilesize
1.8MB
-
memory/1984-91-0x0000000070170000-0x0000000070293000-memory.dmpFilesize
1.1MB
-
memory/1984-90-0x00000000714D0000-0x00000000721ED000-memory.dmpFilesize
13.1MB
-
memory/1984-88-0x00000000721F0000-0x0000000072C00000-memory.dmpFilesize
10.1MB
-
memory/1984-62-0x00000000705B0000-0x0000000070CEE000-memory.dmpFilesize
7.2MB
-
memory/1984-87-0x0000000072C00000-0x0000000073F8F000-memory.dmpFilesize
19.6MB
-
memory/1984-81-0x0000000005C20000-0x0000000005C54000-memory.dmpFilesize
208KB
-
memory/1984-59-0x00000000714D0000-0x00000000721ED000-memory.dmpFilesize
13.1MB
-
memory/1984-58-0x0000000074850000-0x00000000749E4000-memory.dmpFilesize
1.6MB
-
memory/1984-57-0x00000000721F0000-0x0000000072C00000-memory.dmpFilesize
10.1MB
-
memory/1984-56-0x0000000072C00000-0x0000000073F8F000-memory.dmpFilesize
19.6MB
-
memory/2004-101-0x000000006CCD0000-0x000000006CF05000-memory.dmpFilesize
2.2MB
-
memory/2004-111-0x000000006CBA0000-0x000000006CC3C000-memory.dmpFilesize
624KB
-
memory/2004-78-0x000000006DB10000-0x000000006E2AC000-memory.dmpFilesize
7.6MB
-
memory/2004-77-0x000000006E2B0000-0x000000006EDA8000-memory.dmpFilesize
11.0MB
-
memory/2004-76-0x000000006EE50000-0x000000006F3FB000-memory.dmpFilesize
5.7MB
-
memory/2004-70-0x0000000000000000-mapping.dmp
-
memory/2004-92-0x000000006CCD0000-0x000000006CF05000-memory.dmpFilesize
2.2MB
-
memory/2004-94-0x0000000073FD0000-0x0000000073FF5000-memory.dmpFilesize
148KB
-
memory/2004-95-0x000000006CC40000-0x000000006CCC5000-memory.dmpFilesize
532KB
-
memory/2004-96-0x000000006CBA0000-0x000000006CC3C000-memory.dmpFilesize
624KB
-
memory/2004-97-0x000000006CA00000-0x000000006CB9E000-memory.dmpFilesize
1.6MB
-
memory/2004-99-0x000000006F490000-0x000000006F4BD000-memory.dmpFilesize
180KB
-
memory/2004-114-0x000000006CF10000-0x000000006D78A000-memory.dmpFilesize
8.5MB
-
memory/2004-79-0x000000006DA80000-0x000000006DB01000-memory.dmpFilesize
516KB
-
memory/2004-105-0x000000006E2B0000-0x000000006EDA8000-memory.dmpFilesize
11.0MB
-
memory/2004-103-0x000000006DA80000-0x000000006DB01000-memory.dmpFilesize
516KB
-
memory/2004-102-0x000000006DB10000-0x000000006E2AC000-memory.dmpFilesize
7.6MB
-
memory/2004-104-0x000000006EE50000-0x000000006F3FB000-memory.dmpFilesize
5.7MB
-
memory/2004-80-0x000000006CF10000-0x000000006D78A000-memory.dmpFilesize
8.5MB
-
memory/2004-106-0x0000000073FD0000-0x0000000073FF5000-memory.dmpFilesize
148KB
-
memory/2004-107-0x00000000751D0000-0x00000000752E4000-memory.dmpFilesize
1.1MB
-
memory/2004-109-0x000000006F560000-0x000000006F5AB000-memory.dmpFilesize
300KB
-
memory/2004-108-0x000000006CC40000-0x000000006CCC5000-memory.dmpFilesize
532KB
-
memory/2004-110-0x000000006C3F0000-0x000000006C926000-memory.dmpFilesize
5.2MB
-
memory/2004-112-0x0000000074B50000-0x00000000751A1000-memory.dmpFilesize
6.3MB
-
memory/2004-100-0x000000006C2E0000-0x000000006C3E4000-memory.dmpFilesize
1.0MB
-
memory/2004-113-0x000000006CA00000-0x000000006CB9E000-memory.dmpFilesize
1.6MB
-
memory/2004-98-0x000000006C930000-0x000000006C9F3000-memory.dmpFilesize
780KB