Analysis
-
max time kernel
129s -
max time network
194s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
20-07-2021 15:13
Static task
static1
Behavioral task
behavioral1
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win10v20210410
General
-
Target
b2b4962fc5b8df755b981b8eee177ff2.exe
-
Size
643KB
-
MD5
b2b4962fc5b8df755b981b8eee177ff2
-
SHA1
9c0c8898c17c1288bc3edf0b44b2309c5dabd68c
-
SHA256
3eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
-
SHA512
59651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 3 IoCs
Processes:
svchost.exesvchost.exesvchost.exepid process 1796 svchost.exe 2024 svchost.exe 1008 svchost.exe -
Loads dropped DLL 3 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exepid process 912 b2b4962fc5b8df755b981b8eee177ff2.exe 1796 svchost.exe 1796 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process target process PID 528 set thread context of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1796 set thread context of 1008 1796 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exepid process 528 b2b4962fc5b8df755b981b8eee177ff2.exe 1796 svchost.exe 1796 svchost.exe 1796 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process Token: SeDebugPrivilege 528 b2b4962fc5b8df755b981b8eee177ff2.exe Token: SeDebugPrivilege 1796 svchost.exe -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exeb2b4962fc5b8df755b981b8eee177ff2.execmd.exesvchost.exesvchost.exedescription pid process target process PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 528 wrote to memory of 912 528 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 912 wrote to memory of 1388 912 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 912 wrote to memory of 1388 912 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 912 wrote to memory of 1388 912 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 912 wrote to memory of 1388 912 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 912 wrote to memory of 1796 912 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 912 wrote to memory of 1796 912 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 912 wrote to memory of 1796 912 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 912 wrote to memory of 1796 912 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 1388 wrote to memory of 800 1388 cmd.exe reg.exe PID 1388 wrote to memory of 800 1388 cmd.exe reg.exe PID 1388 wrote to memory of 800 1388 cmd.exe reg.exe PID 1388 wrote to memory of 800 1388 cmd.exe reg.exe PID 1796 wrote to memory of 2024 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 2024 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 2024 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 2024 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1796 wrote to memory of 1008 1796 svchost.exe svchost.exe PID 1008 wrote to memory of 1660 1008 svchost.exe cmd.exe PID 1008 wrote to memory of 1660 1008 svchost.exe cmd.exe PID 1008 wrote to memory of 1660 1008 svchost.exe cmd.exe PID 1008 wrote to memory of 1660 1008 svchost.exe cmd.exe PID 1008 wrote to memory of 1660 1008 svchost.exe cmd.exe PID 1008 wrote to memory of 1660 1008 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exeC:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
memory/528-61-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/528-62-0x0000000000BE0000-0x0000000000C2C000-memory.dmpFilesize
304KB
-
memory/528-59-0x0000000000CA0000-0x0000000000CA1000-memory.dmpFilesize
4KB
-
memory/528-67-0x0000000005200000-0x0000000005263000-memory.dmpFilesize
396KB
-
memory/800-77-0x0000000000000000-mapping.dmp
-
memory/912-69-0x0000000000405E28-mapping.dmp
-
memory/912-68-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/912-70-0x0000000075FF1000-0x0000000075FF3000-memory.dmpFilesize
8KB
-
memory/912-71-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1008-91-0x0000000000405E28-mapping.dmp
-
memory/1008-94-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1388-72-0x0000000000000000-mapping.dmp
-
memory/1660-96-0x0000000000000000-mapping.dmp
-
memory/1660-97-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/1796-78-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/1796-80-0x0000000000520000-0x0000000000521000-memory.dmpFilesize
4KB
-
memory/1796-74-0x0000000000000000-mapping.dmp