Analysis

  • max time kernel
    1802s
  • max time network
    1816s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

General

  • Target

    42f972925508a82236e8533567487761.exe

Malware Config

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Attributes
aes_key
DStgwPf5qCYAcWWcPg3CaZBkDbYF3HQo
anti_detection
true
autorun
true
bdos
false
delay
host
sandyclark255.hopto.org
hwid
install_file
install_folder
%AppData%
mutex
adweqsds56332
pastebin_config
null
port
6606,8808,7707
version
0.5.6A
aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • Modifies WinLogon for persistence ⋅ 2 TTPs 3 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

  • Async RAT payload ⋅ 1 IoCs
  • Warzone RAT Payload ⋅ 3 IoCs
  • Disables RegEdit via registry modification
  • Disables Task Manager via registry modification
  • Drops file in Drivers directory ⋅ 1 IoCs
  • Executes dropped EXE ⋅ 17 IoCs
  • Modifies Windows Firewall ⋅ 1 TTPs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file ⋅ 2 IoCs
  • Adds Run key to start application ⋅ 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext ⋅ 7 IoCs
  • Drops file in Windows directory ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 5 IoCs
  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe ⋅ 1 IoCs
  • Modifies registry class ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 4 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:4720
    • C:\Users\Admin\AppData\Local\Temp\JMFP8QdaZdxQNSTc.exe
      "C:\Users\Admin\AppData\Local\Temp\JMFP8QdaZdxQNSTc.exe"
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      PID:3904
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        Executes dropped EXE
        Drops startup file
        Adds Run key to start application
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        PID:4544
        • C:\Windows\SysWOW64\netsh.exe
          netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
          PID:1824
    • C:\Users\Admin\AppData\Local\Temp\DONRS8eiyuFBBYxo.exe
      "C:\Users\Admin\AppData\Local\Temp\DONRS8eiyuFBBYxo.exe"
      Modifies WinLogon for persistence
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4032
      • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
        "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        PID:2168
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 2168
          Modifies WinLogon for persistence
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of AdjustPrivilegeToken
          PID:2444
          • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
            "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
            Executes dropped EXE
            Suspicious use of AdjustPrivilegeToken
            PID:1276
    • C:\Users\Admin\AppData\Local\Temp\FsWGELHnfs75nUAX.exe
      "C:\Users\Admin\AppData\Local\Temp\FsWGELHnfs75nUAX.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2144
      • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
        "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
        Modifies WinLogon for persistence
        Drops file in Drivers directory
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        PID:4156
        • C:\Windows\SysWOW64\notepad.exe
          notepad
          PID:4084
        • C:\Users\Admin\Documents\excelsl.exe
          "C:\Users\Admin\Documents\excelsl.exe"
          Executes dropped EXE
          Suspicious use of SetThreadContext
          Suspicious use of AdjustPrivilegeToken
          PID:8
          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
            "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
            Executes dropped EXE
            Adds Run key to start application
            Suspicious behavior: GetForegroundWindowSpam
            Suspicious use of AdjustPrivilegeToken
            Suspicious use of SetWindowsHookEx
            PID:3100
            • C:\Windows\SysWOW64\notepad.exe
              notepad
              PID:4624
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 8 -s 1068
            Program crash
            PID:3972
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 1076
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:4840
    • C:\Users\Admin\AppData\Local\Temp\nfNIRPKNTDlm5w3t.exe
      "C:\Users\Admin\AppData\Local\Temp\nfNIRPKNTDlm5w3t.exe"
      Executes dropped EXE
      Suspicious use of AdjustPrivilegeToken
      PID:3176
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
        Creates scheduled task(s)
        PID:4412
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp87EE.tmp.bat""
        PID:984
        • C:\Windows\SysWOW64\timeout.exe
          timeout 3
          Delays execution with timeout.exe
          PID:1248
        • C:\Users\Admin\AppData\Roaming\prndrvest.exe
          "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
          Executes dropped EXE
          PID:1452
    • C:\Users\Admin\AppData\Local\Temp\oj6nKcf8t6QM1cww.exe
      "C:\Users\Admin\AppData\Local\Temp\oj6nKcf8t6QM1cww.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4360
      • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
        "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
        Executes dropped EXE
        PID:1188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4360 -s 1068
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:1568
    • C:\Users\Admin\AppData\Local\Temp\xoygXxPNEjZfHSwN.exe
      "C:\Users\Admin\AppData\Local\Temp\xoygXxPNEjZfHSwN.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3816
      • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
        "C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe"
        Executes dropped EXE
        Suspicious behavior: GetForegroundWindowSpam
        PID:2616
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3816 -s 1068
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        PID:4320
    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
      "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
      Executes dropped EXE
      PID:4464
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 1580
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4484

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                    • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\9Wr8gF4Xq79ka0w0\svrhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\DONRS8eiyuFBBYxo.exe
                    • C:\Users\Admin\AppData\Local\Temp\DONRS8eiyuFBBYxo.exe
                    • C:\Users\Admin\AppData\Local\Temp\FsWGELHnfs75nUAX.exe
                    • C:\Users\Admin\AppData\Local\Temp\FsWGELHnfs75nUAX.exe
                    • C:\Users\Admin\AppData\Local\Temp\JMFP8QdaZdxQNSTc.exe
                    • C:\Users\Admin\AppData\Local\Temp\JMFP8QdaZdxQNSTc.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                    • C:\Users\Admin\AppData\Local\Temp\nfNIRPKNTDlm5w3t.exe
                    • C:\Users\Admin\AppData\Local\Temp\nfNIRPKNTDlm5w3t.exe
                    • C:\Users\Admin\AppData\Local\Temp\oj6nKcf8t6QM1cww.exe
                    • C:\Users\Admin\AppData\Local\Temp\oj6nKcf8t6QM1cww.exe
                    • C:\Users\Admin\AppData\Local\Temp\tmp87EE.tmp.bat
                    • C:\Users\Admin\AppData\Local\Temp\xoygXxPNEjZfHSwN.exe
                    • C:\Users\Admin\AppData\Local\Temp\xoygXxPNEjZfHSwN.exe
                    • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                    • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                    • C:\Users\Admin\Documents\excelsl.exe
                    • C:\Users\Admin\Documents\excelsl.exe
                    • C:\Windows\svehosts.exe
                    • C:\Windows\svehosts.exe
                    • memory/8-378-0x0000000000000000-mapping.dmp
                    • memory/8-376-0x0000000000000000-mapping.dmp
                    • memory/8-377-0x0000000000000000-mapping.dmp
                    • memory/8-372-0x0000000000000000-mapping.dmp
                    • memory/8-371-0x0000000000000000-mapping.dmp
                    • memory/8-370-0x0000000000000000-mapping.dmp
                    • memory/8-368-0x0000000000000000-mapping.dmp
                    • memory/8-268-0x0000000000000000-mapping.dmp
                    • memory/8-379-0x0000000000000000-mapping.dmp
                    • memory/8-380-0x0000000000000000-mapping.dmp
                    • memory/8-373-0x0000000000000000-mapping.dmp
                    • memory/8-374-0x0000000000000000-mapping.dmp
                    • memory/984-383-0x0000000000000000-mapping.dmp
                    • memory/1188-69-0x0000000000400000-0x0000000000554000-memory.dmp
                    • memory/1188-65-0x0000000000405CE2-mapping.dmp
                    • memory/1188-63-0x0000000000400000-0x0000000000554000-memory.dmp
                    • memory/1248-385-0x0000000000000000-mapping.dmp
                    • memory/1276-279-0x000000000046A08C-mapping.dmp
                    • memory/1276-283-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/1452-386-0x0000000000000000-mapping.dmp
                    • memory/1452-387-0x0000000000000000-mapping.dmp
                    • memory/1452-390-0x0000000070AE0000-0x00000000711CE000-memory.dmp
                    • memory/1568-102-0x00000000057F0000-0x00000000057F1000-memory.dmp
                    • memory/1568-76-0x0000000004D70000-0x0000000004D71000-memory.dmp
                    • memory/1824-364-0x0000000000000000-mapping.dmp
                    • memory/2144-355-0x0000000000000000-mapping.dmp
                    • memory/2144-238-0x0000000000000000-mapping.dmp
                    • memory/2144-236-0x0000000000000000-mapping.dmp
                    • memory/2144-247-0x0000000000000000-mapping.dmp
                    • memory/2144-234-0x0000000000000000-mapping.dmp
                    • memory/2144-356-0x0000000000000000-mapping.dmp
                    • memory/2144-354-0x0000000000000000-mapping.dmp
                    • memory/2144-352-0x0000000000000000-mapping.dmp
                    • memory/2144-353-0x0000000000000000-mapping.dmp
                    • memory/2144-244-0x0000000000000000-mapping.dmp
                    • memory/2144-241-0x0000000000000000-mapping.dmp
                    • memory/2144-6-0x0000000000000000-mapping.dmp
                    • memory/2168-97-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/2168-88-0x0000000000400000-0x00000000004C2000-memory.dmp
                    • memory/2168-92-0x000000000046A08C-mapping.dmp
                    • memory/2444-104-0x0000000000000000-mapping.dmp
                    • memory/2616-145-0x0000000000400000-0x000000000040F000-memory.dmp
                    • memory/2616-151-0x0000000000400000-0x000000000040F000-memory.dmp
                    • memory/2616-147-0x000000000040715C-mapping.dmp
                    • memory/3100-360-0x000000000048F888-mapping.dmp
                    • memory/3100-362-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/3176-22-0x0000000000310000-0x0000000000311000-memory.dmp
                    • memory/3176-25-0x0000000004C20000-0x0000000004C21000-memory.dmp
                    • memory/3176-13-0x0000000070A70000-0x000000007115E000-memory.dmp
                    • memory/3176-52-0x0000000008F30000-0x0000000008F4D000-memory.dmp
                    • memory/3176-29-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
                    • memory/3176-358-0x000000000AC90000-0x000000000AC91000-memory.dmp
                    • memory/3176-357-0x000000000A980000-0x000000000A981000-memory.dmp
                    • memory/3176-9-0x0000000000000000-mapping.dmp
                    • memory/3176-24-0x0000000005040000-0x0000000005041000-memory.dmp
                    • memory/3176-186-0x00000000046F0000-0x00000000046FD000-memory.dmp
                    • memory/3816-173-0x0000000000000000-mapping.dmp
                    • memory/3816-329-0x0000000000000000-mapping.dmp
                    • memory/3816-165-0x0000000000000000-mapping.dmp
                    • memory/3816-169-0x0000000000000000-mapping.dmp
                    • memory/3816-14-0x0000000000000000-mapping.dmp
                    • memory/3816-171-0x0000000000000000-mapping.dmp
                    • memory/3816-321-0x0000000000000000-mapping.dmp
                    • memory/3816-325-0x0000000000000000-mapping.dmp
                    • memory/3816-323-0x0000000000000000-mapping.dmp
                    • memory/3816-327-0x0000000000000000-mapping.dmp
                    • memory/3816-175-0x0000000000000000-mapping.dmp
                    • memory/3816-163-0x0000000000000000-mapping.dmp
                    • memory/3904-0-0x0000000000000000-mapping.dmp
                    • memory/3972-363-0x00000000046C0000-0x00000000046C1000-memory.dmp
                    • memory/3972-375-0x0000000005210000-0x0000000005211000-memory.dmp
                    • memory/4032-3-0x0000000000000000-mapping.dmp
                    • memory/4084-227-0x0000000000000000-mapping.dmp
                    • memory/4084-231-0x0000000000000000-mapping.dmp
                    • memory/4084-228-0x0000000002F10000-0x0000000002F11000-memory.dmp
                    • memory/4156-214-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/4156-206-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/4156-210-0x000000000048F888-mapping.dmp
                    • memory/4320-181-0x00000000051C0000-0x00000000051C1000-memory.dmp
                    • memory/4320-158-0x00000000046C0000-0x00000000046C1000-memory.dmp
                    • memory/4360-233-0x0000000000000000-mapping.dmp
                    • memory/4360-10-0x0000000000000000-mapping.dmp
                    • memory/4360-87-0x0000000000000000-mapping.dmp
                    • memory/4360-83-0x0000000000000000-mapping.dmp
                    • memory/4360-81-0x0000000000000000-mapping.dmp
                    • memory/4360-85-0x0000000000000000-mapping.dmp
                    • memory/4360-242-0x0000000000000000-mapping.dmp
                    • memory/4360-235-0x0000000000000000-mapping.dmp
                    • memory/4360-245-0x0000000000000000-mapping.dmp
                    • memory/4360-91-0x0000000000000000-mapping.dmp
                    • memory/4360-239-0x0000000000000000-mapping.dmp
                    • memory/4360-94-0x0000000000000000-mapping.dmp
                    • memory/4412-382-0x0000000000000000-mapping.dmp
                    • memory/4464-20-0x000000000048F888-mapping.dmp
                    • memory/4464-19-0x0000000000400000-0x00000000004BA000-memory.dmp
                    • memory/4484-31-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
                    • memory/4484-26-0x00000000044B0000-0x00000000044B1000-memory.dmp
                    • memory/4484-27-0x00000000044B0000-0x00000000044B1000-memory.dmp
                    • memory/4544-162-0x0000000000000000-mapping.dmp
                    • memory/4624-369-0x0000000000000000-mapping.dmp
                    • memory/4624-366-0x0000000000000000-mapping.dmp
                    • memory/4624-367-0x0000000003280000-0x0000000003281000-memory.dmp
                    • memory/4840-252-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
                    • memory/4840-225-0x0000000004320000-0x0000000004321000-memory.dmp