Analysis
-
max time kernel
129s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-07-2021 09:04
Static task
static1
Behavioral task
behavioral1
Sample
034c2c4066cf59acc6911b2c7610aded.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
034c2c4066cf59acc6911b2c7610aded.exe
Resource
win10v20210408
General
-
Target
034c2c4066cf59acc6911b2c7610aded.exe
-
Size
605KB
-
MD5
034c2c4066cf59acc6911b2c7610aded
-
SHA1
49dec1ddfb48686edb1d76183ba51c91cf2868e6
-
SHA256
27c7c159ac96bd76fc993fd76e2ee88106631af414a235a2a1aae1e31100af99
-
SHA512
215736e2453aacee4a85fd3191ee458b7bc77cb7d8b452d65f7d8cf7269d1d7c3e1c8395b4af9d949b5331d71082b13b1ba94c518e187a42b28649bfbdf5bea6
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 4 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exepid process 1320 svchost.exe 3316 svchost.exe 3944 svchost.exe 2276 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
034c2c4066cf59acc6911b2c7610aded.exesvchost.exedescription pid process target process PID 628 set thread context of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 1320 set thread context of 2276 1320 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
034c2c4066cf59acc6911b2c7610aded.exesvchost.exepid process 628 034c2c4066cf59acc6911b2c7610aded.exe 628 034c2c4066cf59acc6911b2c7610aded.exe 1320 svchost.exe 1320 svchost.exe 1320 svchost.exe 1320 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
034c2c4066cf59acc6911b2c7610aded.exesvchost.exedescription pid process Token: SeDebugPrivilege 628 034c2c4066cf59acc6911b2c7610aded.exe Token: SeDebugPrivilege 1320 svchost.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
034c2c4066cf59acc6911b2c7610aded.exe034c2c4066cf59acc6911b2c7610aded.execmd.exesvchost.exesvchost.exedescription pid process target process PID 628 wrote to memory of 2960 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 2960 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 2960 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 628 wrote to memory of 3348 628 034c2c4066cf59acc6911b2c7610aded.exe 034c2c4066cf59acc6911b2c7610aded.exe PID 3348 wrote to memory of 3716 3348 034c2c4066cf59acc6911b2c7610aded.exe cmd.exe PID 3348 wrote to memory of 3716 3348 034c2c4066cf59acc6911b2c7610aded.exe cmd.exe PID 3348 wrote to memory of 3716 3348 034c2c4066cf59acc6911b2c7610aded.exe cmd.exe PID 3348 wrote to memory of 1320 3348 034c2c4066cf59acc6911b2c7610aded.exe svchost.exe PID 3348 wrote to memory of 1320 3348 034c2c4066cf59acc6911b2c7610aded.exe svchost.exe PID 3348 wrote to memory of 1320 3348 034c2c4066cf59acc6911b2c7610aded.exe svchost.exe PID 3716 wrote to memory of 3052 3716 cmd.exe reg.exe PID 3716 wrote to memory of 3052 3716 cmd.exe reg.exe PID 3716 wrote to memory of 3052 3716 cmd.exe reg.exe PID 1320 wrote to memory of 3316 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 3316 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 3316 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 3944 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 3944 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 3944 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 1320 wrote to memory of 2276 1320 svchost.exe svchost.exe PID 2276 wrote to memory of 4032 2276 svchost.exe cmd.exe PID 2276 wrote to memory of 4032 2276 svchost.exe cmd.exe PID 2276 wrote to memory of 4032 2276 svchost.exe cmd.exe PID 2276 wrote to memory of 4032 2276 svchost.exe cmd.exe PID 2276 wrote to memory of 4032 2276 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\034c2c4066cf59acc6911b2c7610aded.exe"C:\Users\Admin\AppData\Local\Temp\034c2c4066cf59acc6911b2c7610aded.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\034c2c4066cf59acc6911b2c7610aded.exe"{path}"2⤵
-
C:\Users\Admin\AppData\Local\Temp\034c2c4066cf59acc6911b2c7610aded.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\svchost.exe"{path}"4⤵
- Executes dropped EXE
-
C:\ProgramData\svchost.exe"{path}"4⤵
- Executes dropped EXE
-
C:\ProgramData\svchost.exe"{path}"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
034c2c4066cf59acc6911b2c7610aded
SHA149dec1ddfb48686edb1d76183ba51c91cf2868e6
SHA25627c7c159ac96bd76fc993fd76e2ee88106631af414a235a2a1aae1e31100af99
SHA512215736e2453aacee4a85fd3191ee458b7bc77cb7d8b452d65f7d8cf7269d1d7c3e1c8395b4af9d949b5331d71082b13b1ba94c518e187a42b28649bfbdf5bea6
-
C:\ProgramData\svchost.exeMD5
034c2c4066cf59acc6911b2c7610aded
SHA149dec1ddfb48686edb1d76183ba51c91cf2868e6
SHA25627c7c159ac96bd76fc993fd76e2ee88106631af414a235a2a1aae1e31100af99
SHA512215736e2453aacee4a85fd3191ee458b7bc77cb7d8b452d65f7d8cf7269d1d7c3e1c8395b4af9d949b5331d71082b13b1ba94c518e187a42b28649bfbdf5bea6
-
C:\ProgramData\svchost.exeMD5
034c2c4066cf59acc6911b2c7610aded
SHA149dec1ddfb48686edb1d76183ba51c91cf2868e6
SHA25627c7c159ac96bd76fc993fd76e2ee88106631af414a235a2a1aae1e31100af99
SHA512215736e2453aacee4a85fd3191ee458b7bc77cb7d8b452d65f7d8cf7269d1d7c3e1c8395b4af9d949b5331d71082b13b1ba94c518e187a42b28649bfbdf5bea6
-
C:\ProgramData\svchost.exeMD5
034c2c4066cf59acc6911b2c7610aded
SHA149dec1ddfb48686edb1d76183ba51c91cf2868e6
SHA25627c7c159ac96bd76fc993fd76e2ee88106631af414a235a2a1aae1e31100af99
SHA512215736e2453aacee4a85fd3191ee458b7bc77cb7d8b452d65f7d8cf7269d1d7c3e1c8395b4af9d949b5331d71082b13b1ba94c518e187a42b28649bfbdf5bea6
-
C:\ProgramData\svchost.exeMD5
034c2c4066cf59acc6911b2c7610aded
SHA149dec1ddfb48686edb1d76183ba51c91cf2868e6
SHA25627c7c159ac96bd76fc993fd76e2ee88106631af414a235a2a1aae1e31100af99
SHA512215736e2453aacee4a85fd3191ee458b7bc77cb7d8b452d65f7d8cf7269d1d7c3e1c8395b4af9d949b5331d71082b13b1ba94c518e187a42b28649bfbdf5bea6
-
memory/628-121-0x0000000008050000-0x0000000008052000-memory.dmpFilesize
8KB
-
memory/628-118-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/628-122-0x0000000006760000-0x00000000067EF000-memory.dmpFilesize
572KB
-
memory/628-123-0x0000000006830000-0x0000000006873000-memory.dmpFilesize
268KB
-
memory/628-116-0x0000000005000000-0x0000000005001000-memory.dmpFilesize
4KB
-
memory/628-117-0x0000000004B00000-0x0000000004B01000-memory.dmpFilesize
4KB
-
memory/628-114-0x0000000000150000-0x0000000000151000-memory.dmpFilesize
4KB
-
memory/628-119-0x0000000000C00000-0x0000000000C01000-memory.dmpFilesize
4KB
-
memory/628-120-0x00000000080D0000-0x00000000080D1000-memory.dmpFilesize
4KB
-
memory/1320-128-0x0000000000000000-mapping.dmp
-
memory/1320-139-0x0000000005200000-0x00000000056FE000-memory.dmpFilesize
5.0MB
-
memory/2276-145-0x0000000000405E28-mapping.dmp
-
memory/2276-147-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/3052-135-0x0000000000000000-mapping.dmp
-
memory/3348-126-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/3348-125-0x0000000000405E28-mapping.dmp
-
memory/3348-124-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/3716-127-0x0000000000000000-mapping.dmp
-
memory/4032-148-0x0000000000000000-mapping.dmp