Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-07-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
-
Size
857KB
-
MD5
79c9d8b2836f1e02af788f10aacdf29a
-
SHA1
d0e460115babb352876b28b2d730fb0a45b1a9e8
-
SHA256
200278c00b708428eb0871bc1dcf4827da6598b15a94e58ac8f296de1957f209
-
SHA512
66024f63f72f564fc5f52fb1f45e79281ee840024992cebfe26526c559c996d1c175e98923cebe300eb9315745728d7e30b839433903eb4217bd96cf43b71f71
Score
8/10
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1748-61-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral1/memory/1748-63-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral1/memory/1748-64-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral1/memory/1748-68-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral1/memory/1748-69-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral1/memory/1748-70-0x0000000000400000-0x00000000004C9000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exedescription pid process target process PID 976 set thread context of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exepid process 1748 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exedescription pid process Token: SeShutdownPrivilege 1748 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe Token: SeDebugPrivilege 1748 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe Token: SeTcbPrivilege 1748 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exepid process 1748 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exedescription pid process target process PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 976 wrote to memory of 1748 976 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/976-54-0x0000000001040000-0x000000000111C000-memory.dmpFilesize
880KB
-
memory/976-55-0x00000000752D1000-0x00000000752D3000-memory.dmpFilesize
8KB
-
memory/976-56-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/976-57-0x0000000000720000-0x000000000072E000-memory.dmpFilesize
56KB
-
memory/976-58-0x0000000007D00000-0x0000000007DA4000-memory.dmpFilesize
656KB
-
memory/976-59-0x00000000050D0000-0x0000000005130000-memory.dmpFilesize
384KB
-
memory/1748-60-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/1748-61-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/1748-63-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/1748-65-0x00000000004C6E10-mapping.dmp
-
memory/1748-64-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/1748-68-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/1748-69-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/1748-70-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB