Analysis
-
max time kernel
91s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 13:51
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.8038.exe
Resource
win7-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.8038.exe
-
Size
46KB
-
MD5
8feba44e8cd040600d09043b3f00e035
-
SHA1
f924b4b27dc76cba38e68937e8aa8297b1656e0a
-
SHA256
359b9f18709357603b88a9597e7779bd36a116a4cccf73c682821ec40bfbeabd
-
SHA512
266d36e4d2d6936b95f20f83f76c095ae260c7f7577d5276cc827c869c392c3bb7d942cf65b5ac6525a4c70c609943e6ab57004e4f5f061307328a439697e2ff
Malware Config
Extracted
formbook
4.1
d94e
123456yudang.com
t-eros.com
genesis-urban.com
gartersnake.xyz
freshinews24.com
molasendo.com
365889.xyz
multiverso-digital.com
nahlabalmsales.com
cashyoga.space
momtipsblog.com
uktbc.xyz
hu6aecfzts33zz.life
luxuryholic.com
wtsgdy.com
bathroomrenovationscenter.club
mouradhw7.xyz
sehoonp.com
danplace.com
zc006.xyz
blogata.xyz
de-vinted.website
photomax.xyz
piratesofthesound.com
slash-sa.com
cloud-computing-security.life
hertgoodusa.xyz
exoticgoldenretrievers-au.com
imagrecimento.xyz
moviechat.xyz
oldchiefs.com
oiuk.xyz
domguri.net
867818.xyz
pisurvice.xyz
realpluscorp.com
bbkicks.store
newsoutgwindow.com
baiakgo.com
healthymebc.com
jxd520.com
jifengys.xyz
dosmatest.store
luxuryhostel.tours
shiba-interstellar.com
ligastavok-mobile.site
lxpioneers.com
asyncbits.com
ahmadiyyamadagascar.com
intl-travel-to-dubai-net.fyi
monassweets.info
qiguz.xyz
suarenda-lucrativa.site
business-china-russia.com
sohufev.xyz
codemicro.site
bitget-signup.website
toonstablerock.com
virtualmarketingseminar.com
rocketbrotherscoffee.biz
wizapk.xyz
mousseinvestmentslimited.com
qqww019.cc
stunningmoon.com
closeones.store
Signatures
-
Formbook Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1176-135-0x0000000000400000-0x000000000042F000-memory.dmp formbook -
Downloads MZ/PE file
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8038.exedescription pid process target process PID 828 set thread context of 1176 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe SecuriteInfo.com.W32.AIDetectNet.01.8038.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8038.exepid process 1176 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe 1176 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8038.exedescription pid process Token: SeDebugPrivilege 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.8038.exedescription pid process target process PID 828 wrote to memory of 1176 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe SecuriteInfo.com.W32.AIDetectNet.01.8038.exe PID 828 wrote to memory of 1176 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe SecuriteInfo.com.W32.AIDetectNet.01.8038.exe PID 828 wrote to memory of 1176 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe SecuriteInfo.com.W32.AIDetectNet.01.8038.exe PID 828 wrote to memory of 1176 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe SecuriteInfo.com.W32.AIDetectNet.01.8038.exe PID 828 wrote to memory of 1176 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe SecuriteInfo.com.W32.AIDetectNet.01.8038.exe PID 828 wrote to memory of 1176 828 SecuriteInfo.com.W32.AIDetectNet.01.8038.exe SecuriteInfo.com.W32.AIDetectNet.01.8038.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8038.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8038.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8038.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.8038.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/828-130-0x0000000000340000-0x0000000000352000-memory.dmpFilesize
72KB
-
memory/828-131-0x00000000053B0000-0x0000000005954000-memory.dmpFilesize
5.6MB
-
memory/828-132-0x0000000004D30000-0x0000000004DC2000-memory.dmpFilesize
584KB
-
memory/828-133-0x0000000006240000-0x00000000062DC000-memory.dmpFilesize
624KB
-
memory/1176-134-0x0000000000000000-mapping.dmp
-
memory/1176-135-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1176-136-0x0000000001590000-0x00000000018DA000-memory.dmpFilesize
3.3MB