Overview

overview

10

Static

static

1

NN.exe

windows7_x64

10

NN.exe

windows10_x64

10

Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-07-2021 02:05

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    NN.exe

  • Size

    255KB

  • MD5

    05682c1439a9ef186645263be47a805d

  • SHA1

    462433cb73898afbf7fb414aa5ab6514961a1cfa

  • SHA256

    47b42d2ab9e369fdc04623df63b3a2b4630eb2028bad42373d10d30d3e85fd41

  • SHA512

    93414bafdcc659e94163e80895241d15341e09b5aef44d83003b68d74c6fdc3940052b4f2cc107340311e9192ffd133487c28f6d68c83fee163910bf99defc88

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

hilipizie.hopto.org:4747

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\NN.exe
    "C:\Users\Admin\AppData\Local\Temp\NN.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\NN.exe
      "C:\Users\Admin\AppData\Local\Temp\NN.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3548
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe"
        3⤵
          PID:1256

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \Users\Admin\AppData\Local\Temp\nsvAD4E.tmp\System.dll
      MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

      SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

      SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

      SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

      Download Submit
    • \Users\Admin\AppData\Local\Temp\nsvAD4E.tmp\System.dll
      MD5

      fccff8cb7a1067e23fd2e2b63971a8e1

      SHA1

      30e2a9e137c1223a78a0f7b0bf96a1c361976d91

      SHA256

      6fcea34c8666b06368379c6c402b5321202c11b00889401c743fb96c516c679e

      SHA512

      f4335e84e6f8d70e462a22f1c93d2998673a7616c868177cac3e8784a3be1d7d0bb96f2583fa0ed82f4f2b6b8f5d9b33521c279a42e055d80a94b4f3f1791e0c

      Download Submit
    • memory/1256-118-0x0000000000000000-mapping.dmp
      Download
    • memory/3548-116-0x0000000000405E28-mapping.dmp
      Download
    • memory/3548-117-0x0000000000400000-0x000000000055E000-memory.dmp
      Filesize

      1.4MB

      Download