Analysis
- max time kernel
128s - max time network
145s - platform
windows10_x64 - resource
win10 - submitted
28/10/2020, 10:01
Static task
static1
Behavioral task
behavioral1
Sample
4489fe80c29aec286a80004ab817aef0.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4489fe80c29aec286a80004ab817aef0.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 4489fe80c29aec286a80004ab817aef0.exe
- Size 358KB
- Sample201028-e2p8xely52
- SHA256 9bbe3fd9a991edfa2f20c9afeb7f6eeb8ac34adfde9d6a5320aed218b1785281
- MD5 4489fe80c29aec286a80004ab817aef0
- SHA1 0b6170a8e311562654fc80e185a6377e1befb27e
- SHA512 9f2e84c4e26b3518663cd45e7429683a788e694a59ae0b8ccf099a2e339491ab375e6e2e37f7be4029aa082a43f2e26eb7eff9549c2413435b2f29eb8ffc6a0f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- ServiceHost packer 14 IoCs
Detects ServiceHost packer used for .NET malware
resource yara_rule behavioral2/memory/1384-36-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-34-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-38-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-39-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-42-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-40-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-43-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-44-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-46-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-47-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-45-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-48-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-49-0x0000000000000000-mapping.dmp servicehost behavioral2/memory/1384-50-0x0000000000000000-mapping.dmp servicehost - Warzone RAT Payload 4 IoCs
resource yara_rule behavioral2/memory/1680-24-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/1680-35-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/1680-37-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/1680-33-0x0000000000405CE2-mapping.dmp warzonerat - Executes dropped EXE 2 IoCs
pid Process 1384 notepads.exe 1680 AddInProcess32.exe - Loads dropped DLL 3 IoCs
pid Process 3876 4489fe80c29aec286a80004ab817aef0.exe 1384 notepads.exe 1384 notepads.exe - Obfuscated with Agile.Net obfuscator 14 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
resource yara_rule behavioral2/memory/1384-36-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-34-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-38-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-39-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-42-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-40-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-43-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-44-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-46-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-47-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-45-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-48-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-49-0x0000000000000000-mapping.dmp agile_net behavioral2/memory/1384-50-0x0000000000000000-mapping.dmp agile_net - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2627584638-3284755310-3019450177-1000\Software\Microsoft\Windows\CurrentVersion\Run\Notepads = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Documents\\notepads.exe" reg.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1384 set thread context of 1680 1384 notepads.exe 81 - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Program crash 2 IoCs
pid pid_target Process procid_target 2296 1680 WerFault.exe 81 2156 1384 WerFault.exe 80 - Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 3876 4489fe80c29aec286a80004ab817aef0.exe 1384 notepads.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe 2296 WerFault.exe 2156 WerFault.exe - Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3876 4489fe80c29aec286a80004ab817aef0.exe Token: SeTakeOwnershipPrivilege 3876 4489fe80c29aec286a80004ab817aef0.exe Token: SeRestorePrivilege 3876 4489fe80c29aec286a80004ab817aef0.exe Token: SeDebugPrivilege 1384 notepads.exe Token: SeTakeOwnershipPrivilege 1384 notepads.exe Token: SeRestorePrivilege 1384 notepads.exe Token: SeRestorePrivilege 2296 WerFault.exe Token: SeBackupPrivilege 2296 WerFault.exe Token: SeRestorePrivilege 2156 WerFault.exe Token: SeBackupPrivilege 2156 WerFault.exe Token: SeBackupPrivilege 2156 WerFault.exe Token: SeDebugPrivilege 2156 WerFault.exe Token: SeDebugPrivilege 2296 WerFault.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3876 wrote to memory of 3572 3876 4489fe80c29aec286a80004ab817aef0.exe 77 PID 3876 wrote to memory of 3572 3876 4489fe80c29aec286a80004ab817aef0.exe 77 PID 3876 wrote to memory of 3572 3876 4489fe80c29aec286a80004ab817aef0.exe 77 PID 3572 wrote to memory of 4044 3572 cmd.exe 79 PID 3572 wrote to memory of 4044 3572 cmd.exe 79 PID 3572 wrote to memory of 4044 3572 cmd.exe 79 PID 3876 wrote to memory of 1384 3876 4489fe80c29aec286a80004ab817aef0.exe 80 PID 3876 wrote to memory of 1384 3876 4489fe80c29aec286a80004ab817aef0.exe 80 PID 3876 wrote to memory of 1384 3876 4489fe80c29aec286a80004ab817aef0.exe 80 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81 PID 1384 wrote to memory of 1680 1384 notepads.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\4489fe80c29aec286a80004ab817aef0.exe"C:\Users\Admin\AppData\Local\Temp\4489fe80c29aec286a80004ab817aef0.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Notepads /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Documents\notepads.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3572 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v Notepads /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Documents\notepads.exe"3⤵
- Adds Run key to start application
PID:4044
-
-
-
C:\Users\Admin\Documents\notepads.exe"C:\Users\Admin\Documents\notepads.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384 -
C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"C:\Users\Admin\AppData\Local\Temp\AddInProcess32.exe"3⤵
- Executes dropped EXE
PID:1680 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1680 -s 5364⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2296
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1384 -s 15443⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-