Analysis
-
max time kernel
153s -
max time network
26s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-05-2021 17:37
Static task
static1
Behavioral task
behavioral1
Sample
eae4ebd7_extracted.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
eae4ebd7_extracted.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
eae4ebd7_extracted.exe
-
Size
100KB
-
MD5
8ab27c0179551ff1815a191c4211977d
-
SHA1
46dc28cb0913ea4ec73b56a0d0bdebe06fdac9ce
-
SHA256
e5dfed32fdfeb0f1562adbbc692458fdfb50fe98f22cc1f8521046eaf1e1a7a7
-
SHA512
96fe4f982202e67b5a87ef4dc0df29f504f38748a1444aa3ec70b2304ea9057cfb490e169e9daaa053b5a2f32b464cd78661daf195e14615d8e742656e0335f3
Score
10/10
Malware Config
Extracted
Family
warzonerat
C2
masterprof.warzonedns.com:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 4 IoCs
resource yara_rule behavioral1/files/0x0003000000013102-61.dat warzonerat behavioral1/files/0x0003000000013102-62.dat warzonerat behavioral1/files/0x0003000000013102-64.dat warzonerat behavioral1/files/0x0003000000013102-67.dat warzonerat -
Executes dropped EXE 1 IoCs
pid Process 1708 images.exe -
Loads dropped DLL 2 IoCs
pid Process 2040 eae4ebd7_extracted.exe 2040 eae4ebd7_extracted.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" eae4ebd7_extracted.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2040 wrote to memory of 1708 2040 eae4ebd7_extracted.exe 29 PID 2040 wrote to memory of 1708 2040 eae4ebd7_extracted.exe 29 PID 2040 wrote to memory of 1708 2040 eae4ebd7_extracted.exe 29 PID 2040 wrote to memory of 1708 2040 eae4ebd7_extracted.exe 29 PID 1708 wrote to memory of 752 1708 images.exe 30 PID 1708 wrote to memory of 752 1708 images.exe 30 PID 1708 wrote to memory of 752 1708 images.exe 30 PID 1708 wrote to memory of 752 1708 images.exe 30 PID 1708 wrote to memory of 752 1708 images.exe 30 PID 1708 wrote to memory of 752 1708 images.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\eae4ebd7_extracted.exe"C:\Users\Admin\AppData\Local\Temp\eae4ebd7_extracted.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:752
-
-