Resubmissions

19-01-2021 19:24

210119-s26yznnqsn 10

19-11-2020 13:14

201119-s41ec6lt86 10

Analysis

  • max time kernel
    1798s
  • max time network
    1814s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    19-11-2020 13:14

General

  • Target

    42f972925508a82236e8533567487761.exe

Malware Config

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Attributes
  • aes_key

    DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo

  • anti_detection

    true

  • autorun

    true

  • bdos

    false

  • delay

  • host

    sandyclark255.hopto.org

  • hwid

  • install_file

  • install_folder

    %AppData%

  • mutex

    adweqsds56332

  • pastebin_config

    null

  • port

    6606,8808,7707

  • version

    0.5.6A

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence ⋅ 2 TTPs 3 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Async RAT payload ⋅ 1 IoCs
  • Warzone RAT Payload ⋅ 3 IoCs
  • Disables RegEdit via registry modification
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory ⋅ 1 IoCs
  • Executes dropped EXE ⋅ 21 IoCs
  • Modifies Windows Firewall ⋅ 1 TTPs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file ⋅ 2 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext ⋅ 7 IoCs
  • Drops file in Windows directory ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 5 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe ⋅ 1 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:576
    • C:\Users\Admin\AppData\Local\Temp\Q84NaqkUOz1eNKMu.exe
      "C:\Users\Admin\AppData\Local\Temp\Q84NaqkUOz1eNKMu.exe"
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2684
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        PID:1620
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          PID:3560
    • C:\Users\Admin\AppData\Local\Temp\eIUVS8yneJWQc7wK.exe
      "C:\Users\Admin\AppData\Local\Temp\eIUVS8yneJWQc7wK.exe"
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:184
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        Executes dropped EXE
        PID:1248
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        PID:2856
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 2856
          Modifies WinLogon for persistence
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of AdjustPrivilegeToken
          PID:1204
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            Executes dropped EXE
            PID:1088
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            Executes dropped EXE
            PID:1608
    • C:\Users\Admin\AppData\Local\Temp\C5LXgE2NTeA6vaqf.exe
      "C:\Users\Admin\AppData\Local\Temp\C5LXgE2NTeA6vaqf.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1800
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        Executes dropped EXE
        PID:1308
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        Executes dropped EXE
        PID:1220
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        PID:2968
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          PID:3532
        • C:\Users\Admin\Documents\excelsl.exe
          "C:\Users\Admin\Documents\excelsl.exe"
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of AdjustPrivilegeToken
          PID:3296
          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
            Executes dropped EXE
            Adds Run key to start application
            Suspicious use of AdjustPrivilegeToken
            Suspicious use of SetWindowsHookEx
            PID:996
            • C:\Windows\SysWOW64\notepad.exe
              notepad
              PID:580
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 3296 -s 1072
            Program crash
            PID:3820
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1084
        Program crash
        Suspicious use of AdjustPrivilegeToken
        PID:492
    • C:\Users\Admin\AppData\Local\Temp\VliD6S25vjFhrcLj.exe
      "C:\Users\Admin\AppData\Local\Temp\VliD6S25vjFhrcLj.exe"
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:2388
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
        Creates scheduled task(s)
        PID:3936
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp5724.tmp.bat""
        PID:1320
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          Delays execution with timeout.exe
          PID:188
        • C:\Users\Admin\AppData\Roaming\prndrvest.exe
          "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
          Executes dropped EXE
          PID:3536
    • C:\Users\Admin\AppData\Local\Temp\RktTKislQvYnnKdo.exe
      "C:\Users\Admin\AppData\Local\Temp\RktTKislQvYnnKdo.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1312
      • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
        "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
        Executes dropped EXE
        PID:716
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1312 -s 1068
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:3424
    • C:\Users\Admin\AppData\Local\Temp\YKbXlrzv2bnCPERW.exe
      "C:\Users\Admin\AppData\Local\Temp\YKbXlrzv2bnCPERW.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1352
      • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
        "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        PID:3932
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1352 -s 1068
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:3172
    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
      "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
      Executes dropped EXE
      PID:3804
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 576 -s 1576
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2204

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                    • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\C5LXgE2NTeA6vaqf.exe
                    • C:\Users\Admin\AppData\Local\Temp\C5LXgE2NTeA6vaqf.exe
                    • C:\Users\Admin\AppData\Local\Temp\Q84NaqkUOz1eNKMu.exe
                    • C:\Users\Admin\AppData\Local\Temp\Q84NaqkUOz1eNKMu.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RktTKislQvYnnKdo.exe
                    • C:\Users\Admin\AppData\Local\Temp\RktTKislQvYnnKdo.exe
                    • C:\Users\Admin\AppData\Local\Temp\VliD6S25vjFhrcLj.exe
                    • C:\Users\Admin\AppData\Local\Temp\VliD6S25vjFhrcLj.exe
                    • C:\Users\Admin\AppData\Local\Temp\YKbXlrzv2bnCPERW.exe
                    • C:\Users\Admin\AppData\Local\Temp\YKbXlrzv2bnCPERW.exe
                    • C:\Users\Admin\AppData\Local\Temp\eIUVS8yneJWQc7wK.exe
                    • C:\Users\Admin\AppData\Local\Temp\eIUVS8yneJWQc7wK.exe
                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\tmp5724.tmp.bat
                    • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                    • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                    • C:\Users\Admin\Documents\excelsl.exe
                    • C:\Users\Admin\Documents\excelsl.exe
                    • C:\Windows\svehosts.exe
                    • C:\Windows\svehosts.exe
                    • memory/184-3-0x0000000000000000-mapping.dmp
                    • memory/188-198-0x0000000000000000-mapping.dmp
                    • memory/492-153-0x0000000004860000-0x0000000004861000-memory.dmp
                    • memory/492-162-0x0000000005490000-0x0000000005491000-memory.dmp
                    • memory/492-151-0x0000000004860000-0x0000000004861000-memory.dmp
                    • memory/580-179-0x0000000000000000-mapping.dmp
                    • memory/580-182-0x0000000000000000-mapping.dmp
                    • memory/580-181-0x00000000004A0000-0x00000000004A1000-memory.dmp
                    • memory/716-35-0x0000000000400000-0x0000000000554000-memory.dmp
                    • memory/716-32-0x0000000000405CE2-mapping.dmp
                    • memory/716-31-0x0000000000400000-0x0000000000554000-memory.dmp
                    • memory/996-175-0x000000000048F888-mapping.dmp
                    • memory/996-177-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/1204-140-0x0000000000000000-mapping.dmp
                    • memory/1312-48-0x0000000000000000-mapping.dmp
                    • memory/1312-43-0x0000000000000000-mapping.dmp
                    • memory/1312-49-0x0000000000000000-mapping.dmp
                    • memory/1312-44-0x0000000000000000-mapping.dmp
                    • memory/1312-47-0x0000000000000000-mapping.dmp
                    • memory/1312-45-0x0000000000000000-mapping.dmp
                    • memory/1312-63-0x0000000000000000-mapping.dmp
                    • memory/1312-65-0x0000000000000000-mapping.dmp
                    • memory/1312-61-0x0000000000000000-mapping.dmp
                    • memory/1312-67-0x0000000000000000-mapping.dmp
                    • memory/1312-68-0x0000000000000000-mapping.dmp
                    • memory/1312-10-0x0000000000000000-mapping.dmp
                    • memory/1320-196-0x0000000000000000-mapping.dmp
                    • memory/1352-133-0x0000000000000000-mapping.dmp
                    • memory/1352-50-0x0000000000000000-mapping.dmp
                    • memory/1352-130-0x0000000000000000-mapping.dmp
                    • memory/1352-131-0x0000000000000000-mapping.dmp
                    • memory/1352-132-0x0000000000000000-mapping.dmp
                    • memory/1352-13-0x0000000000000000-mapping.dmp
                    • memory/1352-134-0x0000000000000000-mapping.dmp
                    • memory/1352-53-0x0000000000000000-mapping.dmp
                    • memory/1352-55-0x0000000000000000-mapping.dmp
                    • memory/1352-58-0x0000000000000000-mapping.dmp
                    • memory/1352-51-0x0000000000000000-mapping.dmp
                    • memory/1352-59-0x0000000000000000-mapping.dmp
                    • memory/1608-194-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/1608-192-0x000000000046A08C-mapping.dmp
                    • memory/1620-95-0x0000000000000000-mapping.dmp
                    • memory/1800-160-0x0000000000000000-mapping.dmp
                    • memory/1800-167-0x0000000000000000-mapping.dmp
                    • memory/1800-168-0x0000000000000000-mapping.dmp
                    • memory/1800-165-0x0000000000000000-mapping.dmp
                    • memory/1800-164-0x0000000000000000-mapping.dmp
                    • memory/1800-6-0x0000000000000000-mapping.dmp
                    • memory/1800-163-0x0000000000000000-mapping.dmp
                    • memory/1800-161-0x0000000000000000-mapping.dmp
                    • memory/1800-158-0x0000000000000000-mapping.dmp
                    • memory/1800-159-0x0000000000000000-mapping.dmp
                    • memory/1800-156-0x0000000000000000-mapping.dmp
                    • memory/1800-157-0x0000000000000000-mapping.dmp
                    • memory/2204-27-0x00000000045A0000-0x00000000045A1000-memory.dmp
                    • memory/2204-28-0x00000000045A0000-0x00000000045A1000-memory.dmp
                    • memory/2204-30-0x0000000005180000-0x0000000005181000-memory.dmp
                    • memory/2388-25-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
                    • memory/2388-172-0x000000000AF10000-0x000000000AF11000-memory.dmp
                    • memory/2388-171-0x000000000ABC0000-0x000000000ABC1000-memory.dmp
                    • memory/2388-42-0x0000000009210000-0x000000000922D000-memory.dmp
                    • memory/2388-14-0x0000000070AA0000-0x000000007118E000-memory.dmp
                    • memory/2388-24-0x0000000005480000-0x0000000005481000-memory.dmp
                    • memory/2388-7-0x0000000000000000-mapping.dmp
                    • memory/2388-80-0x0000000002890000-0x000000000289D000-memory.dmp
                    • memory/2388-26-0x0000000004E90000-0x0000000004E91000-memory.dmp
                    • memory/2388-21-0x00000000005F0000-0x00000000005F1000-memory.dmp
                    • memory/2684-0-0x0000000000000000-mapping.dmp
                    • memory/2856-139-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/2856-136-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/2856-137-0x000000000046A08C-mapping.dmp
                    • memory/2968-148-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/2968-146-0x000000000048F888-mapping.dmp
                    • memory/2968-145-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/3172-46-0x0000000005200000-0x0000000005201000-memory.dmp
                    • memory/3172-62-0x0000000005A80000-0x0000000005A81000-memory.dmp
                    • memory/3296-189-0x0000000000000000-mapping.dmp
                    • memory/3296-188-0x0000000000000000-mapping.dmp
                    • memory/3296-184-0x0000000000000000-mapping.dmp
                    • memory/3296-183-0x0000000000000000-mapping.dmp
                    • memory/3296-166-0x0000000000000000-mapping.dmp
                    • memory/3296-186-0x0000000000000000-mapping.dmp
                    • memory/3296-187-0x0000000000000000-mapping.dmp
                    • memory/3424-52-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
                    • memory/3424-37-0x0000000004180000-0x0000000004181000-memory.dmp
                    • memory/3532-154-0x0000000000000000-mapping.dmp
                    • memory/3532-152-0x00000000009D0000-0x00000000009D1000-memory.dmp
                    • memory/3532-150-0x0000000000000000-mapping.dmp
                    • memory/3536-200-0x0000000000000000-mapping.dmp
                    • memory/3536-199-0x0000000000000000-mapping.dmp
                    • memory/3536-203-0x0000000070B60000-0x000000007124E000-memory.dmp
                    • memory/3560-173-0x0000000000000000-mapping.dmp
                    • memory/3804-20-0x000000000048F888-mapping.dmp
                    • memory/3804-19-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/3820-185-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
                    • memory/3820-180-0x00000000041F0000-0x00000000041F1000-memory.dmp
                    • memory/3932-38-0x000000000040715C-mapping.dmp
                    • memory/3932-36-0x0000000000400000-0x000000000040F000-memory.dmp
                    • memory/3932-41-0x0000000000400000-0x000000000040F000-memory.dmp
                    • memory/3936-195-0x0000000000000000-mapping.dmp