Analysis
- max time kernel
148s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
28/02/2021, 07:20
Static task
static1
Behavioral task
behavioral1
Sample
23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe
- Size 531KB
- Sample210228-798eqs5jbj
- SHA256 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b
- MD5 5e1d1c6786e123dda5600d4e245206f4
- SHA1 6a922c6f7d02b4151c03e126b192a1c7501cc8b2
- SHA512 6b1ee03cacffe1955526d4262c424417e84a046dfb5e8d032f1dac7cd77bb94a4ca77290c96e472875839cda59ef36a00126651c307ec0f8a84b8e26bcf089a8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
andronmatskiv20.sytes.net:5200
Signatures
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 2136 created 4716 2136 WerFault.exe 67 - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 4 IoCs
resource yara_rule behavioral2/memory/4192-4-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4192-5-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/4192-8-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4424-21-0x0000000000405CE2-mapping.dmp warzonerat - Executes dropped EXE 5 IoCs
pid Process 4184 lpteisos.exe 4192 lpteisos.exe 2084 adobesfx.exe 4444 lpteisos.exe 4424 lpteisos.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\adobes = "C:\\ProgramData\\adobesfx.exe" lpteisos.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4716 set thread context of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 2084 set thread context of 4424 2084 adobesfx.exe 85 - Program crash 3 IoCs
pid pid_target Process procid_target 3100 4716 WerFault.exe 67 2136 4716 WerFault.exe 67 4400 2084 WerFault.exe 83 - Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 3100 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2136 WerFault.exe 2084 adobesfx.exe 2084 adobesfx.exe 2084 adobesfx.exe 2084 adobesfx.exe 2084 adobesfx.exe 2084 adobesfx.exe 2084 adobesfx.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe 4400 WerFault.exe - Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeDebugPrivilege 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe Token: 33 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe Token: SeIncBasePriorityPrivilege 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe Token: SeRestorePrivilege 3100 WerFault.exe Token: SeBackupPrivilege 3100 WerFault.exe Token: SeDebugPrivilege 3100 WerFault.exe Token: SeDebugPrivilege 2136 WerFault.exe Token: SeDebugPrivilege 2084 adobesfx.exe Token: 33 2084 adobesfx.exe Token: SeIncBasePriorityPrivilege 2084 adobesfx.exe Token: SeDebugPrivilege 4400 WerFault.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4424 lpteisos.exe - Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 4716 wrote to memory of 4184 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 78 PID 4716 wrote to memory of 4184 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 78 PID 4716 wrote to memory of 4184 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 78 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4716 wrote to memory of 4192 4716 23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe 79 PID 4192 wrote to memory of 2084 4192 lpteisos.exe 83 PID 4192 wrote to memory of 2084 4192 lpteisos.exe 83 PID 4192 wrote to memory of 2084 4192 lpteisos.exe 83 PID 2084 wrote to memory of 4444 2084 adobesfx.exe 84 PID 2084 wrote to memory of 4444 2084 adobesfx.exe 84 PID 2084 wrote to memory of 4444 2084 adobesfx.exe 84 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 2084 wrote to memory of 4424 2084 adobesfx.exe 85 PID 4424 wrote to memory of 4496 4424 lpteisos.exe 87 PID 4424 wrote to memory of 4496 4424 lpteisos.exe 87 PID 4424 wrote to memory of 4496 4424 lpteisos.exe 87 PID 4424 wrote to memory of 4496 4424 lpteisos.exe 87 PID 4424 wrote to memory of 4496 4424 lpteisos.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe"C:\Users\Admin\AppData\Local\Temp\23d488d19e07e94e8aba4bbad7b9b85b6a0a7b19a264d0fe55323aada1ec721b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"2⤵
- Executes dropped EXE
PID:4184
-
-
C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\ProgramData\adobesfx.exe"C:\ProgramData\adobesfx.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2084 -
C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"4⤵
- Executes dropped EXE
PID:4444
-
-
C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"C:\Users\Admin\AppData\Local\Temp\7C07JSt3ZtVEJbm9\lpteisos.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵PID:4496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2084 -s 10444⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4400
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 10842⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3100
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 11162⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2136
-