Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
08-08-2022 03:32
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.W32.AIDetectNet.01.7624.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.W32.AIDetectNet.01.7624.exe
Resource
win10v2004-20220721-en
General
-
Target
SecuriteInfo.com.W32.AIDetectNet.01.7624.exe
-
Size
1.0MB
-
MD5
a80a2a5f4aaee7c7df7f01ca7a919080
-
SHA1
17dc830d904c56709e910c193be53927b2783516
-
SHA256
817eb88f299a32c9937d45886b978c2fcee619c756d4daf33af39604432064f0
-
SHA512
ff5f2808d8252a707c8e7b11a67290d0dac0a6e2d45a717c02384a6240b74e4910bc8497349589c1813122f0c8e49b49dc8a9653b1e9d06b8c970e46aa81e751
Malware Config
Extracted
warzonerat
76.8.53.133:1198
Extracted
redline
IYKE
76.8.53.133:30308
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\build.exe family_redline C:\Users\Admin\AppData\Local\Temp\build.exe family_redline behavioral2/memory/3256-145-0x00000000005A0000-0x00000000005BE000-memory.dmp family_redline -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 2 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\new warzone file.exe warzonerat C:\Users\Admin\AppData\Local\Temp\new warzone file.exe warzonerat -
Executes dropped EXE 2 IoCs
Processes:
new warzone file.exebuild.exepid process 4912 new warzone file.exe 3256 build.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.7624.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.W32.AIDetectNet.01.7624.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.7624.exedescription pid process target process PID 1996 set thread context of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.7624.exepowershell.exepid process 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe 2696 powershell.exe 2696 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.7624.exebuild.exepowershell.exedescription pid process Token: SeDebugPrivilege 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe Token: SeDebugPrivilege 3256 build.exe Token: SeDebugPrivilege 2696 powershell.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.7624.exepid process 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.7624.exepid process 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
SecuriteInfo.com.W32.AIDetectNet.01.7624.exeSecuriteInfo.com.W32.AIDetectNet.01.7624.exenew warzone file.exedescription pid process target process PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1996 wrote to memory of 1816 1996 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe SecuriteInfo.com.W32.AIDetectNet.01.7624.exe PID 1816 wrote to memory of 4912 1816 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe new warzone file.exe PID 1816 wrote to memory of 4912 1816 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe new warzone file.exe PID 1816 wrote to memory of 4912 1816 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe new warzone file.exe PID 1816 wrote to memory of 3256 1816 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe build.exe PID 1816 wrote to memory of 3256 1816 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe build.exe PID 1816 wrote to memory of 3256 1816 SecuriteInfo.com.W32.AIDetectNet.01.7624.exe build.exe PID 4912 wrote to memory of 2696 4912 new warzone file.exe powershell.exe PID 4912 wrote to memory of 2696 4912 new warzone file.exe powershell.exe PID 4912 wrote to memory of 2696 4912 new warzone file.exe powershell.exe PID 4912 wrote to memory of 2716 4912 new warzone file.exe cmd.exe PID 4912 wrote to memory of 2716 4912 new warzone file.exe cmd.exe PID 4912 wrote to memory of 2716 4912 new warzone file.exe cmd.exe PID 4912 wrote to memory of 2716 4912 new warzone file.exe cmd.exe PID 4912 wrote to memory of 2716 4912 new warzone file.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7624.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7624.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7624.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.7624.exe"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\new warzone file.exe"C:\Users\Admin\AppData\Local\Temp\new warzone file.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.W32.AIDetectNet.01.7624.exe.logFilesize
1KB
MD5e08f822522c617a40840c62e4b0fb45e
SHA1ae516dca4da5234be6676d3f234c19ec55725be7
SHA256bd9d5e9f7fe6fcff17d873555d4077d15f7d6cdda1183e7f7d278b735ffe1fd7
SHA512894a7fb7bbc18ac6ba13378f58a7db80ad00d6080be9a66b01cae8e23e41d9d2d4cd53c1e20669356b73590c8a3ebfda4bdda3258f81240db56c4a81b7313fe4
-
C:\Users\Admin\AppData\Local\Temp\build.exeFilesize
95KB
MD5aeb7863b737358d6917750bf34d6bfaf
SHA16fb9f75797adaf6d4745415d740946301c0fefc1
SHA2560653031df30643ea5efa30506bc0bff8ce88fc4a589f69c0260381e982e9e1d5
SHA512c774614f96417748a766147ab03acce9e15d168fa601f84e4ed642073500f483d3d0156d17cbc8382d837b72e7042ac5ec6f2fe1e91a3105672289c299a8a2ea
-
C:\Users\Admin\AppData\Local\Temp\build.exeFilesize
95KB
MD5aeb7863b737358d6917750bf34d6bfaf
SHA16fb9f75797adaf6d4745415d740946301c0fefc1
SHA2560653031df30643ea5efa30506bc0bff8ce88fc4a589f69c0260381e982e9e1d5
SHA512c774614f96417748a766147ab03acce9e15d168fa601f84e4ed642073500f483d3d0156d17cbc8382d837b72e7042ac5ec6f2fe1e91a3105672289c299a8a2ea
-
C:\Users\Admin\AppData\Local\Temp\new warzone file.exeFilesize
113KB
MD54c87cc90157de9ee0ded52059b79b402
SHA1c9b439950937b47c3b1b3c71c09f82215089c5b2
SHA256a27087a5e852d409af70e117cfe6beab449556581876daca7ed6169e27e8ddea
SHA5128880bc3d8ab285481f701bb5f61a43c2933e5fe09183a1414bde07817036be4302e53b48f6ccdd360e940513fb2052014856b310504218e19aea472078d68a79
-
C:\Users\Admin\AppData\Local\Temp\new warzone file.exeFilesize
113KB
MD54c87cc90157de9ee0ded52059b79b402
SHA1c9b439950937b47c3b1b3c71c09f82215089c5b2
SHA256a27087a5e852d409af70e117cfe6beab449556581876daca7ed6169e27e8ddea
SHA5128880bc3d8ab285481f701bb5f61a43c2933e5fe09183a1414bde07817036be4302e53b48f6ccdd360e940513fb2052014856b310504218e19aea472078d68a79
-
memory/1816-137-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1816-136-0x0000000000000000-mapping.dmp
-
memory/1996-132-0x00000000058F0000-0x0000000005982000-memory.dmpFilesize
584KB
-
memory/1996-130-0x0000000000F90000-0x00000000010A0000-memory.dmpFilesize
1.1MB
-
memory/1996-135-0x0000000007D00000-0x0000000007D66000-memory.dmpFilesize
408KB
-
memory/1996-131-0x0000000006060000-0x0000000006604000-memory.dmpFilesize
5.6MB
-
memory/1996-134-0x0000000009290000-0x000000000932C000-memory.dmpFilesize
624KB
-
memory/1996-133-0x0000000005A90000-0x0000000005A9A000-memory.dmpFilesize
40KB
-
memory/2696-166-0x0000000007B10000-0x0000000007B2A000-memory.dmpFilesize
104KB
-
memory/2696-152-0x0000000004EF0000-0x0000000004F26000-memory.dmpFilesize
216KB
-
memory/2696-165-0x0000000007A00000-0x0000000007A0E000-memory.dmpFilesize
56KB
-
memory/2696-164-0x0000000007A50000-0x0000000007AE6000-memory.dmpFilesize
600KB
-
memory/2696-163-0x0000000007840000-0x000000000784A000-memory.dmpFilesize
40KB
-
memory/2696-161-0x0000000007E20000-0x000000000849A000-memory.dmpFilesize
6.5MB
-
memory/2696-162-0x00000000077D0000-0x00000000077EA000-memory.dmpFilesize
104KB
-
memory/2696-150-0x0000000000000000-mapping.dmp
-
memory/2696-160-0x0000000006A70000-0x0000000006A8E000-memory.dmpFilesize
120KB
-
memory/2696-167-0x0000000007AF0000-0x0000000007AF8000-memory.dmpFilesize
32KB
-
memory/2696-153-0x0000000005590000-0x0000000005BB8000-memory.dmpFilesize
6.2MB
-
memory/2696-154-0x0000000005D30000-0x0000000005D52000-memory.dmpFilesize
136KB
-
memory/2696-155-0x0000000005E10000-0x0000000005E76000-memory.dmpFilesize
408KB
-
memory/2696-159-0x0000000071EE0000-0x0000000071F2C000-memory.dmpFilesize
304KB
-
memory/2696-157-0x00000000064D0000-0x00000000064EE000-memory.dmpFilesize
120KB
-
memory/2696-158-0x0000000006A90000-0x0000000006AC2000-memory.dmpFilesize
200KB
-
memory/2716-156-0x0000000001200000-0x0000000001201000-memory.dmpFilesize
4KB
-
memory/2716-151-0x0000000000000000-mapping.dmp
-
memory/3256-148-0x0000000004E70000-0x0000000004EAC000-memory.dmpFilesize
240KB
-
memory/3256-149-0x00000000050F0000-0x00000000051FA000-memory.dmpFilesize
1.0MB
-
memory/3256-147-0x0000000002A90000-0x0000000002AA2000-memory.dmpFilesize
72KB
-
memory/3256-146-0x0000000005540000-0x0000000005B58000-memory.dmpFilesize
6.1MB
-
memory/3256-145-0x00000000005A0000-0x00000000005BE000-memory.dmpFilesize
120KB
-
memory/3256-142-0x0000000000000000-mapping.dmp
-
memory/4912-139-0x0000000000000000-mapping.dmp