Analysis
-
max time kernel
136s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
05-07-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
Resource
win10v2004-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
-
Size
857KB
-
MD5
79c9d8b2836f1e02af788f10aacdf29a
-
SHA1
d0e460115babb352876b28b2d730fb0a45b1a9e8
-
SHA256
200278c00b708428eb0871bc1dcf4827da6598b15a94e58ac8f296de1957f209
-
SHA512
66024f63f72f564fc5f52fb1f45e79281ee840024992cebfe26526c559c996d1c175e98923cebe300eb9315745728d7e30b839433903eb4217bd96cf43b71f71
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4660-138-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4660-140-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4660-141-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4660-142-0x0000000000400000-0x00000000004C9000-memory.dmp upx behavioral2/memory/4660-144-0x0000000000400000-0x00000000004C9000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exedescription pid process target process PID 2156 set thread context of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exepid process 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exepid process 4660 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exeSecuriteInfo.com.W32.AIDetectNet.01.19781.exedescription pid process Token: SeDebugPrivilege 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe Token: SeShutdownPrivilege 4660 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe Token: SeDebugPrivilege 4660 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe Token: SeTcbPrivilege 4660 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exepid process 4660 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.19781.exedescription pid process target process PID 2156 wrote to memory of 4924 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4924 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4924 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe PID 2156 wrote to memory of 4660 2156 SecuriteInfo.com.W32.AIDetectNet.01.19781.exe SecuriteInfo.com.W32.AIDetectNet.01.19781.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.19781.exe"2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2156-130-0x00000000002F0000-0x00000000003CC000-memory.dmpFilesize
880KB
-
memory/2156-131-0x0000000005300000-0x00000000058A4000-memory.dmpFilesize
5.6MB
-
memory/2156-132-0x0000000004C50000-0x0000000004CE2000-memory.dmpFilesize
584KB
-
memory/2156-133-0x0000000004C20000-0x0000000004C2A000-memory.dmpFilesize
40KB
-
memory/2156-134-0x0000000008830000-0x00000000088CC000-memory.dmpFilesize
624KB
-
memory/2156-135-0x0000000008A60000-0x0000000008AC6000-memory.dmpFilesize
408KB
-
memory/4660-140-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/4660-137-0x0000000000000000-mapping.dmp
-
memory/4660-138-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/4660-141-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/4660-142-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/4660-143-0x0000000074B00000-0x0000000074B39000-memory.dmpFilesize
228KB
-
memory/4660-144-0x0000000000400000-0x00000000004C9000-memory.dmpFilesize
804KB
-
memory/4660-145-0x0000000074B00000-0x0000000074B39000-memory.dmpFilesize
228KB
-
memory/4924-136-0x0000000000000000-mapping.dmp