Analysis
-
max time kernel
132s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-07-2021 13:03
Static task
static1
Behavioral task
behavioral1
Sample
2a2c1a9885d3ef548f66188878a59fd2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
2a2c1a9885d3ef548f66188878a59fd2.exe
Resource
win10v20210410
General
-
Target
2a2c1a9885d3ef548f66188878a59fd2.exe
-
Size
684KB
-
MD5
2a2c1a9885d3ef548f66188878a59fd2
-
SHA1
1d480783f56c4448f074cb55a4e2e01338bfdc3b
-
SHA256
04cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
-
SHA512
8fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 3952 svchost.exe 1800 svchost.exe 1848 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exedescription pid process target process PID 1868 set thread context of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 3952 set thread context of 1848 3952 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exepid process 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe 3952 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exesvchost.exedescription pid process Token: SeDebugPrivilege 1868 2a2c1a9885d3ef548f66188878a59fd2.exe Token: SeDebugPrivilege 3952 svchost.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
2a2c1a9885d3ef548f66188878a59fd2.exe2a2c1a9885d3ef548f66188878a59fd2.execmd.exesvchost.exesvchost.exedescription pid process target process PID 1868 wrote to memory of 3792 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 3792 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 3792 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2344 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2344 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2344 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2096 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2096 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2096 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 1868 wrote to memory of 2296 1868 2a2c1a9885d3ef548f66188878a59fd2.exe 2a2c1a9885d3ef548f66188878a59fd2.exe PID 2296 wrote to memory of 3852 2296 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 2296 wrote to memory of 3852 2296 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 2296 wrote to memory of 3852 2296 2a2c1a9885d3ef548f66188878a59fd2.exe cmd.exe PID 2296 wrote to memory of 3952 2296 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 2296 wrote to memory of 3952 2296 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 2296 wrote to memory of 3952 2296 2a2c1a9885d3ef548f66188878a59fd2.exe svchost.exe PID 3852 wrote to memory of 1184 3852 cmd.exe reg.exe PID 3852 wrote to memory of 1184 3852 cmd.exe reg.exe PID 3852 wrote to memory of 1184 3852 cmd.exe reg.exe PID 3952 wrote to memory of 1800 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1800 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1800 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 3952 wrote to memory of 1848 3952 svchost.exe svchost.exe PID 1848 wrote to memory of 3248 1848 svchost.exe cmd.exe PID 1848 wrote to memory of 3248 1848 svchost.exe cmd.exe PID 1848 wrote to memory of 3248 1848 svchost.exe cmd.exe PID 1848 wrote to memory of 3248 1848 svchost.exe cmd.exe PID 1848 wrote to memory of 3248 1848 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe"C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exeC:\Users\Admin\AppData\Local\Temp\2a2c1a9885d3ef548f66188878a59fd2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\ProgramData\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
2a2c1a9885d3ef548f66188878a59fd2
SHA11d480783f56c4448f074cb55a4e2e01338bfdc3b
SHA25604cde0c2284cc4dc8f8a5aeadafca6819ab9d11dfb76fb7f3a2fbbf91d3c0e5d
SHA5128fb432a4c3d21fcb165e0c8c42700f171cfff554045b6a3e1491db70c506bc7cbfa06ee4a18618af5c5dbf3559abb1f703b60acf88c6c5cc5c40c36d7854d1cf
-
memory/1184-136-0x0000000000000000-mapping.dmp
-
memory/1848-155-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1848-152-0x0000000000405E28-mapping.dmp
-
memory/1868-121-0x0000000007110000-0x0000000007111000-memory.dmpFilesize
4KB
-
memory/1868-120-0x0000000007040000-0x000000000708B000-memory.dmpFilesize
300KB
-
memory/1868-117-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/1868-118-0x0000000005550000-0x0000000005551000-memory.dmpFilesize
4KB
-
memory/1868-119-0x00000000054D0000-0x00000000059CE000-memory.dmpFilesize
5.0MB
-
memory/1868-116-0x00000000059D0000-0x00000000059D1000-memory.dmpFilesize
4KB
-
memory/1868-127-0x0000000007B00000-0x0000000007B62000-memory.dmpFilesize
392KB
-
memory/1868-122-0x0000000007230000-0x0000000007231000-memory.dmpFilesize
4KB
-
memory/1868-114-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/2296-128-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/2296-130-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/2296-129-0x0000000000405E28-mapping.dmp
-
memory/3248-157-0x0000000000000000-mapping.dmp
-
memory/3852-131-0x0000000000000000-mapping.dmp
-
memory/3952-132-0x0000000000000000-mapping.dmp
-
memory/3952-154-0x0000000005300000-0x00000000057FE000-memory.dmpFilesize
5.0MB
-
memory/3952-141-0x0000000005300000-0x00000000057FE000-memory.dmpFilesize
5.0MB