Analysis
-
max time kernel
123s -
max time network
124s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
24-11-2020 16:58
Static task
static1
Behavioral task
behavioral1
Sample
angelx.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
angelx.exe
Resource
win10v20201028
General
-
Target
angelx.exe
-
Size
968KB
-
MD5
f9ccd51ac26ac9729efb1386644e09bb
-
SHA1
c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
-
SHA256
e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
-
SHA512
5d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
Malware Config
Extracted
warzonerat
79.134.225.48:3214
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/548-9-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/548-10-0x0000000000405CE2-mapping.dmp warzonerat behavioral1/memory/548-11-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 6 IoCs
Processes:
images.exeimages.exeimages.exeimages.exeimages.exeimages.exepid process 1164 images.exe 1604 images.exe 1636 images.exe 516 images.exe 1632 images.exe 2032 images.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
angelx.exeimages.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion angelx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion angelx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion images.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion images.exe -
Drops startup file 2 IoCs
Processes:
angelx.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start angelx.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat angelx.exe -
Loads dropped DLL 1 IoCs
Processes:
angelx.exepid process 548 angelx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
angelx.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" angelx.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
images.exeangelx.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum angelx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 angelx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum images.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
angelx.exedescription pid process target process PID 1080 set thread context of 548 1080 angelx.exe angelx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1472 schtasks.exe 2016 schtasks.exe -
NTFS ADS 1 IoCs
Processes:
angelx.exedescription ioc process File created C:\ProgramData:ApplicationData angelx.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
angelx.exepowershell.exeimages.exepid process 1080 angelx.exe 428 powershell.exe 428 powershell.exe 1164 images.exe 1164 images.exe 1164 images.exe 1164 images.exe 1164 images.exe 1164 images.exe 1164 images.exe 1164 images.exe 1164 images.exe 1164 images.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
angelx.exepowershell.exeimages.exedescription pid process Token: SeDebugPrivilege 1080 angelx.exe Token: SeDebugPrivilege 428 powershell.exe Token: SeDebugPrivilege 1164 images.exe -
Suspicious use of WriteProcessMemory 48 IoCs
Processes:
angelx.exeangelx.exeimages.exedescription pid process target process PID 1080 wrote to memory of 1472 1080 angelx.exe schtasks.exe PID 1080 wrote to memory of 1472 1080 angelx.exe schtasks.exe PID 1080 wrote to memory of 1472 1080 angelx.exe schtasks.exe PID 1080 wrote to memory of 1472 1080 angelx.exe schtasks.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 1080 wrote to memory of 548 1080 angelx.exe angelx.exe PID 548 wrote to memory of 428 548 angelx.exe powershell.exe PID 548 wrote to memory of 428 548 angelx.exe powershell.exe PID 548 wrote to memory of 428 548 angelx.exe powershell.exe PID 548 wrote to memory of 428 548 angelx.exe powershell.exe PID 548 wrote to memory of 1164 548 angelx.exe images.exe PID 548 wrote to memory of 1164 548 angelx.exe images.exe PID 548 wrote to memory of 1164 548 angelx.exe images.exe PID 548 wrote to memory of 1164 548 angelx.exe images.exe PID 1164 wrote to memory of 2016 1164 images.exe schtasks.exe PID 1164 wrote to memory of 2016 1164 images.exe schtasks.exe PID 1164 wrote to memory of 2016 1164 images.exe schtasks.exe PID 1164 wrote to memory of 2016 1164 images.exe schtasks.exe PID 1164 wrote to memory of 1604 1164 images.exe images.exe PID 1164 wrote to memory of 1604 1164 images.exe images.exe PID 1164 wrote to memory of 1604 1164 images.exe images.exe PID 1164 wrote to memory of 1604 1164 images.exe images.exe PID 1164 wrote to memory of 1636 1164 images.exe images.exe PID 1164 wrote to memory of 1636 1164 images.exe images.exe PID 1164 wrote to memory of 1636 1164 images.exe images.exe PID 1164 wrote to memory of 1636 1164 images.exe images.exe PID 1164 wrote to memory of 516 1164 images.exe images.exe PID 1164 wrote to memory of 516 1164 images.exe images.exe PID 1164 wrote to memory of 516 1164 images.exe images.exe PID 1164 wrote to memory of 516 1164 images.exe images.exe PID 1164 wrote to memory of 1632 1164 images.exe images.exe PID 1164 wrote to memory of 1632 1164 images.exe images.exe PID 1164 wrote to memory of 1632 1164 images.exe images.exe PID 1164 wrote to memory of 1632 1164 images.exe images.exe PID 1164 wrote to memory of 2032 1164 images.exe images.exe PID 1164 wrote to memory of 2032 1164 images.exe images.exe PID 1164 wrote to memory of 2032 1164 images.exe images.exe PID 1164 wrote to memory of 2032 1164 images.exe images.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\angelx.exe"C:\Users\Admin\AppData\Local\Temp\angelx.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TAwqyX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3208.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\angelx.exe"C:\Users\Admin\AppData\Local\Temp\angelx.exe"2⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TAwqyX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2424.tmp"4⤵
- Creates scheduled task(s)
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\Users\Admin\AppData\Local\Temp\tmp2424.tmpMD5
a2c22782ce23079df9500a98709f128f
SHA14be7510716de958a81d04dbc5d1ad3cba276557a
SHA256fc81f3020a32a98d05b06a431bde9f8de54209c7a59b1b0060db64481e73a436
SHA5125eba47218ce9746f2fdd7480414c978cd8c93e78eda9d97b302a09cef9e1dfec0a4365aa2e4fe23f53ea0ca4f5a6528096bea1a9bded027c5f81b65a1c6cb2a0
-
C:\Users\Admin\AppData\Local\Temp\tmp3208.tmpMD5
a2c22782ce23079df9500a98709f128f
SHA14be7510716de958a81d04dbc5d1ad3cba276557a
SHA256fc81f3020a32a98d05b06a431bde9f8de54209c7a59b1b0060db64481e73a436
SHA5125eba47218ce9746f2fdd7480414c978cd8c93e78eda9d97b302a09cef9e1dfec0a4365aa2e4fe23f53ea0ca4f5a6528096bea1a9bded027c5f81b65a1c6cb2a0
-
\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
memory/428-58-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/428-29-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/428-42-0x0000000006170000-0x0000000006171000-memory.dmpFilesize
4KB
-
memory/428-43-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/428-57-0x0000000006230000-0x0000000006231000-memory.dmpFilesize
4KB
-
memory/428-35-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/428-12-0x0000000000000000-mapping.dmp
-
memory/428-34-0x0000000006040000-0x0000000006041000-memory.dmpFilesize
4KB
-
memory/428-22-0x00000000743C0000-0x0000000074AAE000-memory.dmpFilesize
6.9MB
-
memory/428-23-0x0000000001ED0000-0x0000000001ED1000-memory.dmpFilesize
4KB
-
memory/428-24-0x0000000004810000-0x0000000004811000-memory.dmpFilesize
4KB
-
memory/428-25-0x0000000002510000-0x0000000002511000-memory.dmpFilesize
4KB
-
memory/428-26-0x0000000005240000-0x0000000005241000-memory.dmpFilesize
4KB
-
memory/548-10-0x0000000000405CE2-mapping.dmp
-
memory/548-11-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/548-9-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1080-5-0x00000000007A0000-0x00000000007A6000-memory.dmpFilesize
24KB
-
memory/1080-0-0x0000000074710000-0x0000000074DFE000-memory.dmpFilesize
6.9MB
-
memory/1080-6-0x00000000020D0000-0x00000000020EF000-memory.dmpFilesize
124KB
-
memory/1080-4-0x00000000044E0000-0x0000000004534000-memory.dmpFilesize
336KB
-
memory/1080-3-0x00000000006D0000-0x00000000006E4000-memory.dmpFilesize
80KB
-
memory/1080-1-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/1164-14-0x0000000000000000-mapping.dmp
-
memory/1164-17-0x00000000743C0000-0x0000000074AAE000-memory.dmpFilesize
6.9MB
-
memory/1164-19-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/1472-7-0x0000000000000000-mapping.dmp
-
memory/2016-62-0x0000000000000000-mapping.dmp