Analysis
-
max time kernel
130s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-07-2021 14:21
Static task
static1
Behavioral task
behavioral1
Sample
2a2c1a9885d3ef548f66188878a59fd2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2a2c1a9885d3ef548f66188878a59fd2.exe
Resource
win10v20210410
General
-
Target
2a2c1a9885d3ef548f66188878a59fd2.exe
-
Size
684KB
-
MD5
2a2c1a9885d3ef548f66188878a59fd2
-
SHA1
1d480783f56c4448f074cb55a4e2e01338bfdc3b
-
SHA256
04cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
-
SHA512
8fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 4036 svchost.exe 4236 svchost.exe 4232 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exedescription pid process target process PID 4476 set thread context of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4036 set thread context of 4232 4036 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exepid process 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe 4036 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exedescription pid process Token: SeDebugPrivilege 4476 2a2c1a9885d3ef548f66188878a59fd2.exe Token: SeDebugPrivilege 4036 svchost.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exe2a2c1a9885d3ef548f66188878a59fd2.execmd.exesvchost.exesvchost.exedescription pid process target process PID 4476 wrote to memory of 4116 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 4116 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 4116 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 4476 wrote to memory of 2196 4476 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 2196 wrote to memory of 4108 2196 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 2196 wrote to memory of 4108 2196 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 2196 wrote to memory of 4108 2196 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 2196 wrote to memory of 4036 2196 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 2196 wrote to memory of 4036 2196 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 2196 wrote to memory of 4036 2196 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 4108 wrote to memory of 4204 4108 cmd.exe reg.exe PID 4108 wrote to memory of 4204 4108 cmd.exe reg.exe PID 4108 wrote to memory of 4204 4108 cmd.exe reg.exe PID 4036 wrote to memory of 4236 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4236 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4236 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4036 wrote to memory of 4232 4036 svchost.exe svchost.exe PID 4232 wrote to memory of 500 4232 svchost.exe cmd.exe PID 4232 wrote to memory of 500 4232 svchost.exe cmd.exe PID 4232 wrote to memory of 500 4232 svchost.exe cmd.exe PID 4232 wrote to memory of 500 4232 svchost.exe cmd.exe PID 4232 wrote to memory of 500 4232 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe"C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\ProgramData\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
memory/500-157-0x0000000000000000-mapping.dmp
-
memory/2196-128-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/2196-129-0x0000000000405E28-mapping.dmp
-
memory/2196-130-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/4036-132-0x0000000000000000-mapping.dmp
-
memory/4036-154-0x0000000005100000-0x00000000055FE000-memory.dmpFilesize
5.0MB
-
memory/4036-141-0x0000000005100000-0x00000000055FE000-memory.dmpFilesize
5.0MB
-
memory/4108-131-0x0000000000000000-mapping.dmp
-
memory/4204-138-0x0000000000000000-mapping.dmp
-
memory/4232-152-0x0000000000405E28-mapping.dmp
-
memory/4232-155-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/4476-114-0x0000000000DD0000-0x0000000000DD1000-memory.dmpFilesize
4KB
-
memory/4476-127-0x0000000007C50000-0x0000000007CB2000-memory.dmpFilesize
392KB
-
memory/4476-122-0x0000000007390000-0x0000000007391000-memory.dmpFilesize
4KB
-
memory/4476-121-0x0000000007270000-0x0000000007271000-memory.dmpFilesize
4KB
-
memory/4476-120-0x0000000005C30000-0x0000000005C7B000-memory.dmpFilesize
300KB
-
memory/4476-119-0x0000000005780000-0x0000000005C7E000-memory.dmpFilesize
5.0MB
-
memory/4476-118-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/4476-117-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/4476-116-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB