Analysis
-
max time kernel
151s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
06-07-2022 01:36
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.8511.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.8511.exe
-
Size
2.1MB
-
MD5
1ac96e37aa2943e23cbeec35fc69036a
-
SHA1
5ea307c51a3448e2530d9c1879bb62e7ce565260
-
SHA256
17c4e9bf1981229f104d4a129063f9e41275f092724ccf5c1963999ece12c895
-
SHA512
684e5c2964333b9a711c8835079634ef716a9515829572abbef37b4491ce9c362779f84a9b966b4eae5482e4706c90d147df56006b1663a79ce5d8aa875d5e00
Malware Config
Extracted
Family
bitrat
Version
1.38
C2
godfavor.duckdns.org:2349
Attributes
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
tor_process
tor
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1288-61-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1288-63-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1288-64-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1288-66-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1288-67-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1288-68-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1288-70-0x0000000000400000-0x00000000007E4000-memory.dmp upx behavioral1/memory/1288-71-0x0000000000400000-0x00000000007E4000-memory.dmp upx -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8511.exepid process 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8511.exedescription pid process target process PID 1884 set thread context of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8511.exepid process 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8511.exeSecuriteInfo.com.W32.AIDetectNet.01.8511.exedescription pid process Token: SeDebugPrivilege 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe Token: SeDebugPrivilege 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe Token: SeShutdownPrivilege 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8511.exepid process 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe 1288 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8511.exedescription pid process target process PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe PID 1884 wrote to memory of 1288 1884 SecuriteInfo.com.W32.AIDetectNet.01.8511.exe SecuriteInfo.com.W32.AIDetectNet.01.8511.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8511.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8511.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8511.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8511.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1288-67-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-60-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-71-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-70-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-63-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-68-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-66-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-61-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-64-0x0000000000400000-0x00000000007E4000-memory.dmpFilesize
3.9MB
-
memory/1288-65-0x00000000007E2740-mapping.dmp
-
memory/1884-58-0x0000000005EE0000-0x00000000060DA000-memory.dmpFilesize
2.0MB
-
memory/1884-55-0x0000000075191000-0x0000000075193000-memory.dmpFilesize
8KB
-
memory/1884-54-0x0000000000A00000-0x0000000000C22000-memory.dmpFilesize
2.1MB
-
memory/1884-59-0x0000000005940000-0x0000000005AF6000-memory.dmpFilesize
1.7MB
-
memory/1884-57-0x00000000008B0000-0x00000000008BE000-memory.dmpFilesize
56KB
-
memory/1884-56-0x0000000000550000-0x0000000000570000-memory.dmpFilesize
128KB