Analysis

  • max time kernel
    145s
  • max time network
    176s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    12-07-2021 08:44

General

  • Target

    e6b478f5fc73dc7318854399abf505e3.exe

  • Size

    908KB

  • MD5

    e6b478f5fc73dc7318854399abf505e3

  • SHA1

    802fb03026a04b4027c3ff7fdf521d08195f8163

  • SHA256

    99f6194509980cce34f244d9dbca6d6931f47a02361db73e0f2fc1fa103c997b

  • SHA512

    9f94e00e1b30130e06749868dc5e492b74f47a67169b5e064ab09fc51fba01e4583adf0b3e730852bba272cfb6d7395f8d6c0078addb59f4b6cdd3c1874ae3d4

Malware Config

Extracted

Family

warzonerat

C2

byx.z86.ru:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6b478f5fc73dc7318854399abf505e3.exe
    "C:\Users\Admin\AppData\Local\Temp\e6b478f5fc73dc7318854399abf505e3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1028
    • C:\Users\Admin\AppData\Local\Temp\e6b478f5fc73dc7318854399abf505e3.exe
      "{path}"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1432
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1880
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
          4⤵
            PID:1848
        • C:\ProgramData\svchost.exe
          "C:\ProgramData\svchost.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of WriteProcessMemory
          PID:1896
          • C:\ProgramData\svchost.exe
            "{path}"
            4⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:1956
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe"
              5⤵
                PID:1692

      Network

      MITRE ATT&CK Matrix

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\ProgramData\svchost.exe
        MD5

        e6b478f5fc73dc7318854399abf505e3

        SHA1

        802fb03026a04b4027c3ff7fdf521d08195f8163

        SHA256

        99f6194509980cce34f244d9dbca6d6931f47a02361db73e0f2fc1fa103c997b

        SHA512

        9f94e00e1b30130e06749868dc5e492b74f47a67169b5e064ab09fc51fba01e4583adf0b3e730852bba272cfb6d7395f8d6c0078addb59f4b6cdd3c1874ae3d4

      • C:\ProgramData\svchost.exe
        MD5

        e6b478f5fc73dc7318854399abf505e3

        SHA1

        802fb03026a04b4027c3ff7fdf521d08195f8163

        SHA256

        99f6194509980cce34f244d9dbca6d6931f47a02361db73e0f2fc1fa103c997b

        SHA512

        9f94e00e1b30130e06749868dc5e492b74f47a67169b5e064ab09fc51fba01e4583adf0b3e730852bba272cfb6d7395f8d6c0078addb59f4b6cdd3c1874ae3d4

      • C:\ProgramData\svchost.exe
        MD5

        e6b478f5fc73dc7318854399abf505e3

        SHA1

        802fb03026a04b4027c3ff7fdf521d08195f8163

        SHA256

        99f6194509980cce34f244d9dbca6d6931f47a02361db73e0f2fc1fa103c997b

        SHA512

        9f94e00e1b30130e06749868dc5e492b74f47a67169b5e064ab09fc51fba01e4583adf0b3e730852bba272cfb6d7395f8d6c0078addb59f4b6cdd3c1874ae3d4

      • \ProgramData\svchost.exe
        MD5

        e6b478f5fc73dc7318854399abf505e3

        SHA1

        802fb03026a04b4027c3ff7fdf521d08195f8163

        SHA256

        99f6194509980cce34f244d9dbca6d6931f47a02361db73e0f2fc1fa103c997b

        SHA512

        9f94e00e1b30130e06749868dc5e492b74f47a67169b5e064ab09fc51fba01e4583adf0b3e730852bba272cfb6d7395f8d6c0078addb59f4b6cdd3c1874ae3d4

      • memory/1028-62-0x00000000047B0000-0x00000000047B1000-memory.dmp
        Filesize

        4KB

      • memory/1028-63-0x0000000000440000-0x0000000000442000-memory.dmp
        Filesize

        8KB

      • memory/1028-64-0x00000000073B0000-0x0000000007434000-memory.dmp
        Filesize

        528KB

      • memory/1028-65-0x0000000000550000-0x0000000000588000-memory.dmp
        Filesize

        224KB

      • memory/1028-60-0x0000000000D50000-0x0000000000D51000-memory.dmp
        Filesize

        4KB

      • memory/1432-66-0x0000000000400000-0x000000000055E000-memory.dmp
        Filesize

        1.4MB

      • memory/1432-69-0x0000000000400000-0x000000000055E000-memory.dmp
        Filesize

        1.4MB

      • memory/1432-68-0x00000000750C1000-0x00000000750C3000-memory.dmp
        Filesize

        8KB

      • memory/1432-67-0x0000000000405E28-mapping.dmp
      • memory/1692-87-0x0000000000000000-mapping.dmp
      • memory/1848-77-0x0000000000000000-mapping.dmp
      • memory/1880-70-0x0000000000000000-mapping.dmp
      • memory/1896-72-0x0000000000000000-mapping.dmp
      • memory/1896-75-0x0000000001340000-0x0000000001341000-memory.dmp
        Filesize

        4KB

      • memory/1896-79-0x00000000070C0000-0x00000000070C1000-memory.dmp
        Filesize

        4KB

      • memory/1956-83-0x0000000000405E28-mapping.dmp
      • memory/1956-86-0x0000000000400000-0x000000000055E000-memory.dmp
        Filesize

        1.4MB