Analysis
-
max time kernel
145s -
max time network
179s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-07-2021 13:03
Static task
static1
Behavioral task
behavioral1
Sample
2a2c1a9885d3ef548f66188878a59fd2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2a2c1a9885d3ef548f66188878a59fd2.exe
Resource
win10v20210410
General
-
Target
2a2c1a9885d3ef548f66188878a59fd2.exe
-
Size
684KB
-
MD5
2a2c1a9885d3ef548f66188878a59fd2
-
SHA1
1d480783f56c4448f074cb55a4e2e01338bfdc3b
-
SHA256
04cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
-
SHA512
8fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 1516 svchost.exe 928 svchost.exe 1372 svchost.exe -
Loads dropped DLL 3 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exepid process 592 2a2c1a9885d3ef548f66188878a59fd2.exe 1516 svchost.exe 1516 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exedescription pid process target process PID 1036 set thread context of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1516 set thread context of 1372 1516 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exepid process 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 1516 svchost.exe 1516 svchost.exe 1516 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exedescription pid process Token: SeDebugPrivilege 1036 2a2c1a9885d3ef548f66188878a59fd2.exe Token: SeDebugPrivilege 1516 svchost.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exe2a2c1a9885d3ef548f66188878a59fd2.execmd.exesvchost.exesvchost.exedescription pid process target process PID 1036 wrote to memory of 1700 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 1700 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 1700 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 1700 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 112 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 112 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 112 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 112 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 268 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 268 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 268 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 268 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 548 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 548 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 548 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 548 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1036 wrote to memory of 592 1036 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 592 wrote to memory of 1072 592 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 592 wrote to memory of 1072 592 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 592 wrote to memory of 1072 592 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 592 wrote to memory of 1072 592 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 592 wrote to memory of 1516 592 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 592 wrote to memory of 1516 592 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 592 wrote to memory of 1516 592 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 592 wrote to memory of 1516 592 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 1072 wrote to memory of 1576 1072 cmd.exe reg.exe PID 1072 wrote to memory of 1576 1072 cmd.exe reg.exe PID 1072 wrote to memory of 1576 1072 cmd.exe reg.exe PID 1072 wrote to memory of 1576 1072 cmd.exe reg.exe PID 1516 wrote to memory of 928 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 928 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 928 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 928 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1516 wrote to memory of 1372 1516 svchost.exe svchost.exe PID 1372 wrote to memory of 1396 1372 svchost.exe cmd.exe PID 1372 wrote to memory of 1396 1372 svchost.exe cmd.exe PID 1372 wrote to memory of 1396 1372 svchost.exe cmd.exe PID 1372 wrote to memory of 1396 1372 svchost.exe cmd.exe PID 1372 wrote to memory of 1396 1372 svchost.exe cmd.exe PID 1372 wrote to memory of 1396 1372 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe"C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\ProgramData\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
\ProgramData\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
memory/592-69-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/592-72-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/592-70-0x0000000000405E28-mapping.dmp
-
memory/592-71-0x0000000075721000-0x0000000075723000-memory.dmpFilesize
8KB
-
memory/1036-68-0x0000000004CB5000-0x0000000004CC6000-memory.dmpFilesize
68KB
-
memory/1036-61-0x0000000004CB0000-0x0000000004CB1000-memory.dmpFilesize
4KB
-
memory/1036-62-0x00000000004F0000-0x000000000053B000-memory.dmpFilesize
300KB
-
memory/1036-59-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1036-67-0x0000000005AE0000-0x0000000005B42000-memory.dmpFilesize
392KB
-
memory/1072-73-0x0000000000000000-mapping.dmp
-
memory/1372-93-0x0000000000405E28-mapping.dmp
-
memory/1372-96-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1396-98-0x0000000000000000-mapping.dmp
-
memory/1516-75-0x0000000000000000-mapping.dmp
-
memory/1516-88-0x0000000000685000-0x0000000000696000-memory.dmpFilesize
68KB
-
memory/1516-81-0x0000000000680000-0x0000000000681000-memory.dmpFilesize
4KB
-
memory/1516-78-0x0000000000FF0000-0x0000000000FF1000-memory.dmpFilesize
4KB
-
memory/1576-79-0x0000000000000000-mapping.dmp