Analysis
-
max time kernel
89s -
max time network
62s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
05-05-2021 02:23
Static task
static1
Behavioral task
behavioral1
Sample
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe
Resource
win10v20210410
General
-
Target
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe
-
Size
1.8MB
-
MD5
b78f5c47acef55129ff8d9862c477dcf
-
SHA1
4c8d602143a1a2fd5201ec4214cee155101e5911
-
SHA256
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1
-
SHA512
d18d7a9999a9f50236efe551667dc9c6e226cfd6151a45d7712d980779599d9f5f81f74d97910b73f907e0ba54a85fb38fb5c489ac3cbbbaf49a39f7be28330e
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 7 IoCs
Processes:
resource yara_rule \Windows\system\explorer.exe warzonerat \Windows\system\explorer.exe warzonerat C:\Windows\system\explorer.exe warzonerat \??\c:\windows\system\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe warzonerat C:\Users\Admin\AppData\Local\Temp\Disk.sys warzonerat C:\Windows\system\explorer.exe warzonerat -
Executes dropped EXE 2 IoCs
Processes:
explorer.exeexplorer.exepid process 328 explorer.exe 436 explorer.exe -
Loads dropped DLL 2 IoCs
Processes:
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exepid process 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exeexplorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exeexplorer.exedescription pid process target process PID 1640 set thread context of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 set thread context of 1636 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe diskperf.exe PID 328 set thread context of 436 328 explorer.exe explorer.exe PID 328 set thread context of 1500 328 explorer.exe diskperf.exe -
Drops file in Windows directory 1 IoCs
Processes:
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exedescription ioc process File opened for modification \??\c:\windows\system\explorer.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exepid process 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exepid process 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exebc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exeexplorer.exedescription pid process target process PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 872 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe PID 1640 wrote to memory of 1636 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe diskperf.exe PID 1640 wrote to memory of 1636 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe diskperf.exe PID 1640 wrote to memory of 1636 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe diskperf.exe PID 1640 wrote to memory of 1636 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe diskperf.exe PID 1640 wrote to memory of 1636 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe diskperf.exe PID 1640 wrote to memory of 1636 1640 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe diskperf.exe PID 872 wrote to memory of 328 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe explorer.exe PID 872 wrote to memory of 328 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe explorer.exe PID 872 wrote to memory of 328 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe explorer.exe PID 872 wrote to memory of 328 872 bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 436 328 explorer.exe explorer.exe PID 328 wrote to memory of 1500 328 explorer.exe diskperf.exe PID 328 wrote to memory of 1500 328 explorer.exe diskperf.exe PID 328 wrote to memory of 1500 328 explorer.exe diskperf.exe PID 328 wrote to memory of 1500 328 explorer.exe diskperf.exe PID 328 wrote to memory of 1500 328 explorer.exe diskperf.exe PID 328 wrote to memory of 1500 328 explorer.exe diskperf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe"C:\Users\Admin\AppData\Local\Temp\bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe"C:\Users\Admin\AppData\Local\Temp\bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1.exe"2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"4⤵
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exeMD5
b78f5c47acef55129ff8d9862c477dcf
SHA14c8d602143a1a2fd5201ec4214cee155101e5911
SHA256bc630e07cf99324ac65fb506e9d54bbd6d405887070604e00d98c52ba60d64c1
SHA512d18d7a9999a9f50236efe551667dc9c6e226cfd6151a45d7712d980779599d9f5f81f74d97910b73f907e0ba54a85fb38fb5c489ac3cbbbaf49a39f7be28330e
-
C:\Users\Admin\AppData\Local\Temp\Disk.sysMD5
bf2f9d9c0bd10fb63ae02e1458ada392
SHA12bacb310c1bd5c8554205f7fd2253167fdf77cb8
SHA25668b3dddb8859b61906cac55293b47be8f5fa3e20fdf62b69c5cd0c3c028bae31
SHA512d51ed5e5b27b1ec7ada5976541fb6fb003e2488c27be0614dc1ced3b2359c68ae02f0f958f1469e7ed3fe242de0d7d95faf6a6f339037c5cd5f4a19400aee41f
-
C:\Windows\system\explorer.exeMD5
bf2f9d9c0bd10fb63ae02e1458ada392
SHA12bacb310c1bd5c8554205f7fd2253167fdf77cb8
SHA25668b3dddb8859b61906cac55293b47be8f5fa3e20fdf62b69c5cd0c3c028bae31
SHA512d51ed5e5b27b1ec7ada5976541fb6fb003e2488c27be0614dc1ced3b2359c68ae02f0f958f1469e7ed3fe242de0d7d95faf6a6f339037c5cd5f4a19400aee41f
-
C:\Windows\system\explorer.exeMD5
bf2f9d9c0bd10fb63ae02e1458ada392
SHA12bacb310c1bd5c8554205f7fd2253167fdf77cb8
SHA25668b3dddb8859b61906cac55293b47be8f5fa3e20fdf62b69c5cd0c3c028bae31
SHA512d51ed5e5b27b1ec7ada5976541fb6fb003e2488c27be0614dc1ced3b2359c68ae02f0f958f1469e7ed3fe242de0d7d95faf6a6f339037c5cd5f4a19400aee41f
-
\??\c:\windows\system\explorer.exeMD5
bf2f9d9c0bd10fb63ae02e1458ada392
SHA12bacb310c1bd5c8554205f7fd2253167fdf77cb8
SHA25668b3dddb8859b61906cac55293b47be8f5fa3e20fdf62b69c5cd0c3c028bae31
SHA512d51ed5e5b27b1ec7ada5976541fb6fb003e2488c27be0614dc1ced3b2359c68ae02f0f958f1469e7ed3fe242de0d7d95faf6a6f339037c5cd5f4a19400aee41f
-
\Windows\system\explorer.exeMD5
bf2f9d9c0bd10fb63ae02e1458ada392
SHA12bacb310c1bd5c8554205f7fd2253167fdf77cb8
SHA25668b3dddb8859b61906cac55293b47be8f5fa3e20fdf62b69c5cd0c3c028bae31
SHA512d51ed5e5b27b1ec7ada5976541fb6fb003e2488c27be0614dc1ced3b2359c68ae02f0f958f1469e7ed3fe242de0d7d95faf6a6f339037c5cd5f4a19400aee41f
-
\Windows\system\explorer.exeMD5
bf2f9d9c0bd10fb63ae02e1458ada392
SHA12bacb310c1bd5c8554205f7fd2253167fdf77cb8
SHA25668b3dddb8859b61906cac55293b47be8f5fa3e20fdf62b69c5cd0c3c028bae31
SHA512d51ed5e5b27b1ec7ada5976541fb6fb003e2488c27be0614dc1ced3b2359c68ae02f0f958f1469e7ed3fe242de0d7d95faf6a6f339037c5cd5f4a19400aee41f
-
memory/328-77-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/328-74-0x0000000000000000-mapping.dmp
-
memory/436-80-0x0000000000403670-mapping.dmp
-
memory/872-70-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/872-62-0x0000000000403670-mapping.dmp
-
memory/872-61-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1500-86-0x0000000000411000-mapping.dmp
-
memory/1636-71-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1636-65-0x0000000000411000-mapping.dmp
-
memory/1636-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1640-59-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/1640-60-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB