Analysis
-
max time kernel
146s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-11-2020 16:58
Static task
static1
Behavioral task
behavioral1
Sample
angelx.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
angelx.exe
Resource
win10v20201028
General
-
Target
angelx.exe
-
Size
968KB
-
MD5
f9ccd51ac26ac9729efb1386644e09bb
-
SHA1
c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
-
SHA256
e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
-
SHA512
5d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
Malware Config
Extracted
warzonerat
79.134.225.48:3214
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Warzone RAT Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/1116-15-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/1116-16-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/1116-17-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4492-64-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/4492-66-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 1356 images.exe 4492 images.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
images.exeangelx.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion images.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion angelx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion angelx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion images.exe -
Drops startup file 2 IoCs
Processes:
angelx.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat angelx.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start angelx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
angelx.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" angelx.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
angelx.exeimages.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum angelx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 angelx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum images.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 images.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
angelx.exeimages.exedescription pid process target process PID 4752 set thread context of 1116 4752 angelx.exe angelx.exe PID 1356 set thread context of 4492 1356 images.exe images.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
NTFS ADS 1 IoCs
Processes:
angelx.exedescription ioc process File created C:\ProgramData:ApplicationData angelx.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
angelx.exepowershell.exeimages.exepowershell.exepid process 4752 angelx.exe 4752 angelx.exe 4752 angelx.exe 1316 powershell.exe 1316 powershell.exe 1316 powershell.exe 1356 images.exe 3996 powershell.exe 3996 powershell.exe 3996 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
angelx.exepowershell.exeimages.exepowershell.exedescription pid process Token: SeDebugPrivilege 4752 angelx.exe Token: SeDebugPrivilege 1316 powershell.exe Token: SeDebugPrivilege 1356 images.exe Token: SeDebugPrivilege 3996 powershell.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
angelx.exeangelx.exeimages.exeimages.exedescription pid process target process PID 4752 wrote to memory of 932 4752 angelx.exe schtasks.exe PID 4752 wrote to memory of 932 4752 angelx.exe schtasks.exe PID 4752 wrote to memory of 932 4752 angelx.exe schtasks.exe PID 4752 wrote to memory of 1080 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1080 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1080 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 4752 wrote to memory of 1116 4752 angelx.exe angelx.exe PID 1116 wrote to memory of 1316 1116 angelx.exe powershell.exe PID 1116 wrote to memory of 1316 1116 angelx.exe powershell.exe PID 1116 wrote to memory of 1316 1116 angelx.exe powershell.exe PID 1116 wrote to memory of 1356 1116 angelx.exe images.exe PID 1116 wrote to memory of 1356 1116 angelx.exe images.exe PID 1116 wrote to memory of 1356 1116 angelx.exe images.exe PID 1356 wrote to memory of 2064 1356 images.exe schtasks.exe PID 1356 wrote to memory of 2064 1356 images.exe schtasks.exe PID 1356 wrote to memory of 2064 1356 images.exe schtasks.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 1356 wrote to memory of 4492 1356 images.exe images.exe PID 4492 wrote to memory of 3996 4492 images.exe powershell.exe PID 4492 wrote to memory of 3996 4492 images.exe powershell.exe PID 4492 wrote to memory of 3996 4492 images.exe powershell.exe PID 4492 wrote to memory of 4532 4492 images.exe cmd.exe PID 4492 wrote to memory of 4532 4492 images.exe cmd.exe PID 4492 wrote to memory of 4532 4492 images.exe cmd.exe PID 4492 wrote to memory of 4532 4492 images.exe cmd.exe PID 4492 wrote to memory of 4532 4492 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\angelx.exe"C:\Users\Admin\AppData\Local\Temp\angelx.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TAwqyX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3A6A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\angelx.exe"C:\Users\Admin\AppData\Local\Temp\angelx.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\angelx.exe"C:\Users\Admin\AppData\Local\Temp\angelx.exe"2⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TAwqyX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1AB8.tmp"4⤵
- Creates scheduled task(s)
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
db01a2c1c7e70b2b038edf8ad5ad9826
SHA1540217c647a73bad8d8a79e3a0f3998b5abd199b
SHA256413da361d77055dae7007f82b58b366c8783aa72e0b8fbe41519b940c253b38d
SHA512c76ff57fcee5cdf9fdf3116d4e1dc0cf106867bf19ab474b763e242acf5dca9a7509cb837c35e130c3e056636b4e8a4e135512a978bcd3dd641e20f5bf76c3d6
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
9bc467db76d3a092c9bea2c49466abf8
SHA1f3d41ec072bc59ae90f1cdbe07351d730b3ce8cd
SHA256e88eee1c9f21b4fc8af9060dc4061654506eea27759602dbde88195f84e04c0e
SHA512b6fc0dbf92b84a8167aec96315db5fdb5a791f86ea75745bfe965ddf7ca79256d15fa827c60b0aa930520854dfa53a7690ed7f08d51c0c6369f643d1ff37e3a9
-
C:\Users\Admin\AppData\Local\Temp\tmp1AB8.tmpMD5
7893e6cb77c378a46ac78b86e6e1cb5f
SHA17a93bfe06768628545772e59a3eb683882a2700a
SHA25670d0042bef272c4e1eaec508d6d53155a873c18cf7e19dcaac6944076f61cc19
SHA5123c2cfe5ca770488ef3839390bdcac6c0a1dff95e9021e14cbfb53b68f67648df6aa7263cd367c8e66f10f14475a742f21b4a07c2c3f5d1588e6f160f62fd4cd2
-
C:\Users\Admin\AppData\Local\Temp\tmp3A6A.tmpMD5
7893e6cb77c378a46ac78b86e6e1cb5f
SHA17a93bfe06768628545772e59a3eb683882a2700a
SHA25670d0042bef272c4e1eaec508d6d53155a873c18cf7e19dcaac6944076f61cc19
SHA5123c2cfe5ca770488ef3839390bdcac6c0a1dff95e9021e14cbfb53b68f67648df6aa7263cd367c8e66f10f14475a742f21b4a07c2c3f5d1588e6f160f62fd4cd2
-
memory/932-13-0x0000000000000000-mapping.dmp
-
memory/1116-17-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1116-16-0x0000000000405CE2-mapping.dmp
-
memory/1116-15-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1316-35-0x0000000006B10000-0x0000000006B11000-memory.dmpFilesize
4KB
-
memory/1316-50-0x0000000008920000-0x0000000008921000-memory.dmpFilesize
4KB
-
memory/1316-55-0x0000000008DE0000-0x0000000008DE1000-memory.dmpFilesize
4KB
-
memory/1316-53-0x0000000008DF0000-0x0000000008DF1000-memory.dmpFilesize
4KB
-
memory/1316-52-0x0000000008E40000-0x0000000008E41000-memory.dmpFilesize
4KB
-
memory/1316-18-0x0000000000000000-mapping.dmp
-
memory/1316-51-0x0000000008A80000-0x0000000008A81000-memory.dmpFilesize
4KB
-
memory/1316-43-0x0000000008940000-0x0000000008973000-memory.dmpFilesize
204KB
-
memory/1316-41-0x0000000007C20000-0x0000000007C21000-memory.dmpFilesize
4KB
-
memory/1316-40-0x00000000078F0000-0x00000000078F1000-memory.dmpFilesize
4KB
-
memory/1316-39-0x0000000006D90000-0x0000000006D91000-memory.dmpFilesize
4KB
-
memory/1316-26-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/1316-30-0x00000000065D0000-0x00000000065D1000-memory.dmpFilesize
4KB
-
memory/1316-33-0x0000000006DC0000-0x0000000006DC1000-memory.dmpFilesize
4KB
-
memory/1316-38-0x00000000075A0000-0x00000000075A1000-memory.dmpFilesize
4KB
-
memory/1316-36-0x0000000006BB0000-0x0000000006BB1000-memory.dmpFilesize
4KB
-
memory/1356-19-0x0000000000000000-mapping.dmp
-
memory/1356-22-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/2064-61-0x0000000000000000-mapping.dmp
-
memory/3996-70-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/3996-67-0x0000000000000000-mapping.dmp
-
memory/3996-92-0x0000000009710000-0x0000000009711000-memory.dmpFilesize
4KB
-
memory/3996-79-0x00000000087E0000-0x00000000087E1000-memory.dmpFilesize
4KB
-
memory/3996-76-0x0000000007E60000-0x0000000007E61000-memory.dmpFilesize
4KB
-
memory/4492-66-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/4492-64-0x0000000000405CE2-mapping.dmp
-
memory/4532-68-0x0000000000000000-mapping.dmp
-
memory/4532-81-0x0000000000000000-mapping.dmp
-
memory/4532-80-0x0000000002E30000-0x0000000002E31000-memory.dmpFilesize
4KB
-
memory/4752-3-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/4752-8-0x0000000005B70000-0x0000000005B84000-memory.dmpFilesize
80KB
-
memory/4752-10-0x0000000005E00000-0x0000000005E06000-memory.dmpFilesize
24KB
-
memory/4752-4-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB
-
memory/4752-11-0x0000000006710000-0x000000000672F000-memory.dmpFilesize
124KB
-
memory/4752-0-0x0000000073150000-0x000000007383E000-memory.dmpFilesize
6.9MB
-
memory/4752-9-0x00000000065A0000-0x00000000065F4000-memory.dmpFilesize
336KB
-
memory/4752-1-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4752-7-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/4752-5-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/4752-6-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/4752-12-0x0000000006800000-0x0000000006801000-memory.dmpFilesize
4KB