Analysis
- max time kernel
151s - max time network
159s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
16/06/2022, 06:39
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.19268.exe
- Size 2.3MB
- Sample220616-hel4mshhh5
- SHA256 b484edef2132ebb9af301e05295fd56bc7298db9fbb8c6ce43b6297950b0e4e2
Score
5/10
Malware Config
Signatures
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19268.exe"4⤵
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
SecuriteInfo.com.W32.AIDetectNet.01.19268.exe.log
memory/1060-142-0x0000000005A00000-0x0000000005AAA000-memory.dmp
memory/1060-141-0x0000000000400000-0x00000000004BA000-memory.dmp
memory/2712-139-0x0000000000400000-0x0000000000522000-memory.dmp
memory/3776-133-0x0000000004EB0000-0x0000000004EBA000-memory.dmp
memory/3776-134-0x0000000008F50000-0x0000000008FEC000-memory.dmp
memory/3776-130-0x00000000002C0000-0x0000000000508000-memory.dmp
memory/3776-132-0x0000000004F20000-0x0000000004FB2000-memory.dmp
memory/3776-131-0x00000000054D0000-0x0000000005A74000-memory.dmp
memory/4188-136-0x0000000000400000-0x000000000059A000-memory.dmp