Analysis
-
max time kernel
76s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 17:40
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.4166.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetectNet.01.4166.exe
Resource
win10v2004-20220414-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.4166.exe
-
Size
52KB
-
MD5
1f90ecea05ef9adfaa814d95a750f4ef
-
SHA1
71bfea6663dbfc06e228113e44723e91bf46f619
-
SHA256
4f3642f36e5ba22aec031ad20349200b39114fdb470b78247f1c1a5626146a87
-
SHA512
644696c4973d8ca08c8d054238688aa2a76ea97abe434608e77d82def125d714f21d59b8d35faceb80fdca52b6a0a580f7c1303c2c67fa65088df70c4d5d05cb
Malware Config
Signatures
-
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
suricata: ET MALWARE Generic AsyncRAT Style SSL Cert
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.W32.AIDetectNet.01.4166.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Xhaienfx = "\"C:\\Users\\Admin\\AppData\\Roaming\\Vropvbhcy\\Xhaienfx.exe\"" SecuriteInfo.com.W32.AIDetectNet.01.4166.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exedescription pid process target process PID 3472 set thread context of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exepowershell.exeSecuriteInfo.com.W32.AIDetectNet.01.4166.exepid process 3848 powershell.exe 3848 powershell.exe 2256 powershell.exe 2256 powershell.exe 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exepowershell.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe Token: SeDebugPrivilege 3848 powershell.exe Token: SeDebugPrivilege 2256 powershell.exe Token: SeDebugPrivilege 4756 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.4166.exedescription pid process target process PID 3472 wrote to memory of 3848 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 3472 wrote to memory of 3848 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 3472 wrote to memory of 3848 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 3472 wrote to memory of 2256 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 3472 wrote to memory of 2256 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 3472 wrote to memory of 2256 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe powershell.exe PID 3472 wrote to memory of 5060 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 5060 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 5060 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe PID 3472 wrote to memory of 4756 3472 SecuriteInfo.com.W32.AIDetectNet.01.4166.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4166.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.4166.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwADsAIABTAGUAdAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJwBDADoAXAAnAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5f126124474b20c5c8a5633f3b10a89d3
SHA1322c89057baa805c2b4e490328963aab954fd225
SHA256e3a23c630dc96d2f25fd7223a013f02be260c5ce97e96a740301afe2e90fafcd
SHA5125eee2c4a861daa5740fddc773a0680c44c01e7842f53943d5ea9a40d49ed0dd85b767b18b684995169ba193a28ac12e653cd102e2df93728d16a25d85bd258e7
-
memory/2256-148-0x0000000007B90000-0x0000000007C26000-memory.dmpFilesize
600KB
-
memory/2256-149-0x0000000007B30000-0x0000000007B3E000-memory.dmpFilesize
56KB
-
memory/2256-151-0x0000000007C30000-0x0000000007C38000-memory.dmpFilesize
32KB
-
memory/2256-150-0x0000000007C50000-0x0000000007C6A000-memory.dmpFilesize
104KB
-
memory/2256-147-0x0000000007990000-0x000000000799A000-memory.dmpFilesize
40KB
-
memory/2256-146-0x0000000007800000-0x000000000781E000-memory.dmpFilesize
120KB
-
memory/2256-145-0x000000006FDB0000-0x000000006FDFC000-memory.dmpFilesize
304KB
-
memory/2256-140-0x0000000000000000-mapping.dmp
-
memory/2256-144-0x0000000007820000-0x0000000007852000-memory.dmpFilesize
200KB
-
memory/3472-130-0x00000000006E0000-0x00000000006F2000-memory.dmpFilesize
72KB
-
memory/3848-139-0x0000000004E00000-0x0000000004E1A000-memory.dmpFilesize
104KB
-
memory/3848-136-0x0000000005A60000-0x0000000005AC6000-memory.dmpFilesize
408KB
-
memory/3848-132-0x0000000002AA0000-0x0000000002AD6000-memory.dmpFilesize
216KB
-
memory/3848-138-0x00000000076E0000-0x0000000007D5A000-memory.dmpFilesize
6.5MB
-
memory/3848-137-0x0000000006090000-0x00000000060AE000-memory.dmpFilesize
120KB
-
memory/3848-131-0x0000000000000000-mapping.dmp
-
memory/3848-134-0x00000000050D0000-0x00000000050F2000-memory.dmpFilesize
136KB
-
memory/3848-133-0x0000000005220000-0x0000000005848000-memory.dmpFilesize
6.2MB
-
memory/3848-135-0x0000000005940000-0x00000000059A6000-memory.dmpFilesize
408KB
-
memory/4756-153-0x0000000000000000-mapping.dmp
-
memory/4756-154-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4756-155-0x0000000005920000-0x00000000059BC000-memory.dmpFilesize
624KB
-
memory/4756-156-0x0000000006110000-0x00000000066B4000-memory.dmpFilesize
5.6MB
-
memory/5060-152-0x0000000000000000-mapping.dmp