Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-11-2020 16:57
Static task
static1
Behavioral task
behavioral1
Sample
angelx.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
angelx.exe
Resource
win10v20201028
General
-
Target
angelx.exe
-
Size
968KB
-
MD5
f9ccd51ac26ac9729efb1386644e09bb
-
SHA1
c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
-
SHA256
e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
-
SHA512
5d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
Malware Config
Extracted
warzonerat
79.134.225.48:3214
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Warzone RAT Payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/512-15-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/512-16-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/512-17-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/3848-66-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/3848-64-0x0000000000405CE2-mapping.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 1564 images.exe 3848 images.exe -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
images.exeangelx.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion images.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion angelx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion angelx.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion images.exe -
Drops startup file 2 IoCs
Processes:
angelx.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat angelx.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start angelx.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
angelx.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" angelx.exe -
Maps connected drives based on registry 3 TTPs 4 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
angelx.exeimages.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum angelx.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 angelx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum images.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0 images.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
angelx.exeimages.exedescription pid process target process PID 3984 set thread context of 512 3984 angelx.exe angelx.exe PID 1564 set thread context of 3848 1564 images.exe images.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1244 schtasks.exe 3168 schtasks.exe -
NTFS ADS 1 IoCs
Processes:
angelx.exedescription ioc process File created C:\ProgramData:ApplicationData angelx.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
angelx.exepowershell.exeimages.exepowershell.exepid process 3984 angelx.exe 3940 powershell.exe 3940 powershell.exe 3940 powershell.exe 1564 images.exe 3704 powershell.exe 3704 powershell.exe 3704 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
angelx.exepowershell.exeimages.exepowershell.exedescription pid process Token: SeDebugPrivilege 3984 angelx.exe Token: SeDebugPrivilege 3940 powershell.exe Token: SeDebugPrivilege 1564 images.exe Token: SeDebugPrivilege 3704 powershell.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
angelx.exeangelx.exeimages.exeimages.exedescription pid process target process PID 3984 wrote to memory of 1244 3984 angelx.exe schtasks.exe PID 3984 wrote to memory of 1244 3984 angelx.exe schtasks.exe PID 3984 wrote to memory of 1244 3984 angelx.exe schtasks.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 3984 wrote to memory of 512 3984 angelx.exe angelx.exe PID 512 wrote to memory of 3940 512 angelx.exe powershell.exe PID 512 wrote to memory of 3940 512 angelx.exe powershell.exe PID 512 wrote to memory of 3940 512 angelx.exe powershell.exe PID 512 wrote to memory of 1564 512 angelx.exe images.exe PID 512 wrote to memory of 1564 512 angelx.exe images.exe PID 512 wrote to memory of 1564 512 angelx.exe images.exe PID 1564 wrote to memory of 3168 1564 images.exe schtasks.exe PID 1564 wrote to memory of 3168 1564 images.exe schtasks.exe PID 1564 wrote to memory of 3168 1564 images.exe schtasks.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 1564 wrote to memory of 3848 1564 images.exe images.exe PID 3848 wrote to memory of 3704 3848 images.exe powershell.exe PID 3848 wrote to memory of 3704 3848 images.exe powershell.exe PID 3848 wrote to memory of 3704 3848 images.exe powershell.exe PID 3848 wrote to memory of 2760 3848 images.exe cmd.exe PID 3848 wrote to memory of 2760 3848 images.exe cmd.exe PID 3848 wrote to memory of 2760 3848 images.exe cmd.exe PID 3848 wrote to memory of 2760 3848 images.exe cmd.exe PID 3848 wrote to memory of 2760 3848 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\angelx.exe"C:\Users\Admin\AppData\Local\Temp\angelx.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TAwqyX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1703.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\angelx.exe"C:\Users\Admin\AppData\Local\Temp\angelx.exe"2⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TAwqyX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF211.tmp"4⤵
- Creates scheduled task(s)
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\MD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\ProgramData\images.exeMD5
f9ccd51ac26ac9729efb1386644e09bb
SHA1c90cb01be628c0c00e70629ef1d0916d2aa1c2aa
SHA256e876e9815b602f4e6c022d682c62cf45a6c750ea1a3b10665b792b9ccf705cc4
SHA5125d072857e1976e34b99d06cfae94637a9a8f2e0df68be0b8ab8a8dcfe8af735c9f988a9f6e563aa26004163de1f3c3c03b4bfecfb17cd47b957820210ebeedc9
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
1fbe25025f8cec1bee8f8ad53b476e74
SHA1fd74723899eca5c0c056eba29f73e27a35e6bcef
SHA2569862d58eb8e02ff9eb3c68a71f549559af40d7db580aa5f376114f2f88da272a
SHA512a6b1f98936e200f78f008dd08003f3285924077a632aa45eadbc65379867a6b6852b02ba4bcdcd9162455d95c773c46fa56a98847a6f1167f4435dcf900eb003
-
C:\Users\Admin\AppData\Local\Temp\tmp1703.tmpMD5
e723e2d53e6b599b5f17d641d6d52cd9
SHA191f9bfea70b1b0e66f7ddc90ac8370a251371aa7
SHA2569cafaabbb2a6e470827a554e9cfca4a8dc0ba416c6e4a8739ced823dd789825e
SHA5125b85daefa614bd0d0f5e04a422513dc6008330f214025e6426a35e6397856f908e190f42d64e513412bb78aff3d776ea83a7edce0fc27aed3edd46eb550f2b99
-
C:\Users\Admin\AppData\Local\Temp\tmpF211.tmpMD5
e723e2d53e6b599b5f17d641d6d52cd9
SHA191f9bfea70b1b0e66f7ddc90ac8370a251371aa7
SHA2569cafaabbb2a6e470827a554e9cfca4a8dc0ba416c6e4a8739ced823dd789825e
SHA5125b85daefa614bd0d0f5e04a422513dc6008330f214025e6426a35e6397856f908e190f42d64e513412bb78aff3d776ea83a7edce0fc27aed3edd46eb550f2b99
-
memory/512-15-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/512-16-0x0000000000405CE2-mapping.dmp
-
memory/512-17-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1244-13-0x0000000000000000-mapping.dmp
-
memory/1564-19-0x0000000000000000-mapping.dmp
-
memory/1564-22-0x0000000073890000-0x0000000073F7E000-memory.dmpFilesize
6.9MB
-
memory/2760-68-0x0000000000000000-mapping.dmp
-
memory/2760-79-0x0000000000000000-mapping.dmp
-
memory/2760-78-0x0000000002FF0000-0x0000000002FF1000-memory.dmpFilesize
4KB
-
memory/3168-61-0x0000000000000000-mapping.dmp
-
memory/3704-76-0x0000000008150000-0x0000000008151000-memory.dmpFilesize
4KB
-
memory/3704-70-0x0000000073940000-0x000000007402E000-memory.dmpFilesize
6.9MB
-
memory/3704-81-0x0000000008720000-0x0000000008721000-memory.dmpFilesize
4KB
-
memory/3704-67-0x0000000000000000-mapping.dmp
-
memory/3704-92-0x0000000009760000-0x0000000009761000-memory.dmpFilesize
4KB
-
memory/3848-64-0x0000000000405CE2-mapping.dmp
-
memory/3848-66-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/3940-41-0x0000000007F30000-0x0000000007F31000-memory.dmpFilesize
4KB
-
memory/3940-30-0x0000000006E60000-0x0000000006E61000-memory.dmpFilesize
4KB
-
memory/3940-36-0x0000000007560000-0x0000000007561000-memory.dmpFilesize
4KB
-
memory/3940-38-0x0000000007830000-0x0000000007831000-memory.dmpFilesize
4KB
-
memory/3940-39-0x0000000007690000-0x0000000007691000-memory.dmpFilesize
4KB
-
memory/3940-40-0x0000000008160000-0x0000000008161000-memory.dmpFilesize
4KB
-
memory/3940-18-0x0000000000000000-mapping.dmp
-
memory/3940-43-0x0000000008CE0000-0x0000000008D13000-memory.dmpFilesize
204KB
-
memory/3940-50-0x0000000008CC0000-0x0000000008CC1000-memory.dmpFilesize
4KB
-
memory/3940-51-0x0000000009030000-0x0000000009031000-memory.dmpFilesize
4KB
-
memory/3940-52-0x00000000091F0000-0x00000000091F1000-memory.dmpFilesize
4KB
-
memory/3940-53-0x00000000091A0000-0x00000000091A1000-memory.dmpFilesize
4KB
-
memory/3940-55-0x0000000009190000-0x0000000009191000-memory.dmpFilesize
4KB
-
memory/3940-35-0x00000000074C0000-0x00000000074C1000-memory.dmpFilesize
4KB
-
memory/3940-23-0x0000000073890000-0x0000000073F7E000-memory.dmpFilesize
6.9MB
-
memory/3940-28-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/3984-4-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/3984-6-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/3984-5-0x0000000004F70000-0x0000000004F71000-memory.dmpFilesize
4KB
-
memory/3984-7-0x00000000051A0000-0x00000000051A1000-memory.dmpFilesize
4KB
-
memory/3984-3-0x0000000004E30000-0x0000000004E31000-memory.dmpFilesize
4KB
-
memory/3984-8-0x0000000004F30000-0x0000000004F44000-memory.dmpFilesize
80KB
-
memory/3984-10-0x00000000059D0000-0x00000000059D6000-memory.dmpFilesize
24KB
-
memory/3984-1-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/3984-0-0x0000000073920000-0x000000007400E000-memory.dmpFilesize
6.9MB
-
memory/3984-9-0x0000000005C10000-0x0000000005C64000-memory.dmpFilesize
336KB
-
memory/3984-12-0x0000000005E30000-0x0000000005E31000-memory.dmpFilesize
4KB
-
memory/3984-11-0x00000000059F0000-0x0000000005A0F000-memory.dmpFilesize
124KB