Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
16-07-2021 00:02
Static task
static1
Behavioral task
behavioral1
Sample
5289ee592197e853ca284d082bd0355e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
5289ee592197e853ca284d082bd0355e.exe
Resource
win10v20210408
General
-
Target
5289ee592197e853ca284d082bd0355e.exe
-
Size
371KB
-
MD5
5289ee592197e853ca284d082bd0355e
-
SHA1
32b33a3e0c77a5bd9a09ac35e9d237db2782609e
-
SHA256
d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
-
SHA512
9a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 6 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 904 svchost.exe 672 svchost.exe 1704 svchost.exe 1868 svchost.exe 1988 svchost.exe 1992 svchost.exe -
Loads dropped DLL 6 IoCs
Processes:
5289ee592197e853ca284d082bd0355e.exesvchost.exepid process 700 5289ee592197e853ca284d082bd0355e.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5289ee592197e853ca284d082bd0355e.exesvchost.exedescription pid process target process PID 788 set thread context of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 904 set thread context of 1992 904 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
5289ee592197e853ca284d082bd0355e.exesvchost.exepid process 788 5289ee592197e853ca284d082bd0355e.exe 788 5289ee592197e853ca284d082bd0355e.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe 904 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5289ee592197e853ca284d082bd0355e.exesvchost.exedescription pid process Token: SeDebugPrivilege 788 5289ee592197e853ca284d082bd0355e.exe Token: SeDebugPrivilege 904 svchost.exe -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
5289ee592197e853ca284d082bd0355e.exe5289ee592197e853ca284d082bd0355e.execmd.exesvchost.exesvchost.exedescription pid process target process PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 788 wrote to memory of 700 788 5289ee592197e853ca284d082bd0355e.exe 5289ee592197e853ca284d082bd0355e.exe PID 700 wrote to memory of 300 700 5289ee592197e853ca284d082bd0355e.exe cmd.exe PID 700 wrote to memory of 300 700 5289ee592197e853ca284d082bd0355e.exe cmd.exe PID 700 wrote to memory of 300 700 5289ee592197e853ca284d082bd0355e.exe cmd.exe PID 700 wrote to memory of 300 700 5289ee592197e853ca284d082bd0355e.exe cmd.exe PID 700 wrote to memory of 904 700 5289ee592197e853ca284d082bd0355e.exe svchost.exe PID 700 wrote to memory of 904 700 5289ee592197e853ca284d082bd0355e.exe svchost.exe PID 700 wrote to memory of 904 700 5289ee592197e853ca284d082bd0355e.exe svchost.exe PID 700 wrote to memory of 904 700 5289ee592197e853ca284d082bd0355e.exe svchost.exe PID 300 wrote to memory of 796 300 cmd.exe reg.exe PID 300 wrote to memory of 796 300 cmd.exe reg.exe PID 300 wrote to memory of 796 300 cmd.exe reg.exe PID 300 wrote to memory of 796 300 cmd.exe reg.exe PID 904 wrote to memory of 672 904 svchost.exe svchost.exe PID 904 wrote to memory of 672 904 svchost.exe svchost.exe PID 904 wrote to memory of 672 904 svchost.exe svchost.exe PID 904 wrote to memory of 672 904 svchost.exe svchost.exe PID 904 wrote to memory of 1704 904 svchost.exe svchost.exe PID 904 wrote to memory of 1704 904 svchost.exe svchost.exe PID 904 wrote to memory of 1704 904 svchost.exe svchost.exe PID 904 wrote to memory of 1704 904 svchost.exe svchost.exe PID 904 wrote to memory of 1868 904 svchost.exe svchost.exe PID 904 wrote to memory of 1868 904 svchost.exe svchost.exe PID 904 wrote to memory of 1868 904 svchost.exe svchost.exe PID 904 wrote to memory of 1868 904 svchost.exe svchost.exe PID 904 wrote to memory of 1988 904 svchost.exe svchost.exe PID 904 wrote to memory of 1988 904 svchost.exe svchost.exe PID 904 wrote to memory of 1988 904 svchost.exe svchost.exe PID 904 wrote to memory of 1988 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 904 wrote to memory of 1992 904 svchost.exe svchost.exe PID 1992 wrote to memory of 1772 1992 svchost.exe cmd.exe PID 1992 wrote to memory of 1772 1992 svchost.exe cmd.exe PID 1992 wrote to memory of 1772 1992 svchost.exe cmd.exe PID 1992 wrote to memory of 1772 1992 svchost.exe cmd.exe PID 1992 wrote to memory of 1772 1992 svchost.exe cmd.exe PID 1992 wrote to memory of 1772 1992 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5289ee592197e853ca284d082bd0355e.exe"C:\Users\Admin\AppData\Local\Temp\5289ee592197e853ca284d082bd0355e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5289ee592197e853ca284d082bd0355e.exeC:\Users\Admin\AppData\Local\Temp\5289ee592197e853ca284d082bd0355e.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
C:\ProgramData\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
\ProgramData\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
5289ee592197e853ca284d082bd0355e
SHA132b33a3e0c77a5bd9a09ac35e9d237db2782609e
SHA256d966b0be571e5da5143ec930b1cf99c053412ecfdb76d46b16ba811c16e9eb8b
SHA5129a7d715e0e9d0a199aa2a40c4c193accdd12105908d62db2a0e46100b9518b4479afe7c3f8b4ba1922e6874fd3041987e6334bc4964546e97684f02e09a0f63a
-
memory/300-69-0x0000000000000000-mapping.dmp
-
memory/700-68-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/700-66-0x0000000000405E28-mapping.dmp
-
memory/700-65-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/700-67-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/788-62-0x0000000004C95000-0x0000000004CA6000-memory.dmpFilesize
68KB
-
memory/788-64-0x0000000000BA0000-0x0000000000C06000-memory.dmpFilesize
408KB
-
memory/788-59-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/788-61-0x0000000004C90000-0x0000000004C91000-memory.dmpFilesize
4KB
-
memory/788-63-0x0000000000590000-0x00000000005DD000-memory.dmpFilesize
308KB
-
memory/796-76-0x0000000000000000-mapping.dmp
-
memory/904-78-0x0000000004DD5000-0x0000000004DE6000-memory.dmpFilesize
68KB
-
memory/904-71-0x0000000000000000-mapping.dmp
-
memory/904-77-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/904-74-0x00000000010C0000-0x00000000010C1000-memory.dmpFilesize
4KB
-
memory/1772-96-0x0000000000000000-mapping.dmp
-
memory/1772-97-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1992-91-0x0000000000405E28-mapping.dmp
-
memory/1992-94-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB