Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-07-2021 15:13
Static task
static1
Behavioral task
behavioral1
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win10v20210410
General
-
Target
b2b4962fc5b8df755b981b8eee177ff2.exe
-
Size
643KB
-
MD5
b2b4962fc5b8df755b981b8eee177ff2
-
SHA1
9c0c8898c17c1288bc3edf0b44b2309c5dabd68c
-
SHA256
3eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
-
SHA512
59651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 3828 svchost.exe 3392 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process target process PID 3156 set thread context of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3828 set thread context of 3392 3828 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exepid process 3156 b2b4962fc5b8df755b981b8eee177ff2.exe 3156 b2b4962fc5b8df755b981b8eee177ff2.exe 3156 b2b4962fc5b8df755b981b8eee177ff2.exe 3156 b2b4962fc5b8df755b981b8eee177ff2.exe 3156 b2b4962fc5b8df755b981b8eee177ff2.exe 3156 b2b4962fc5b8df755b981b8eee177ff2.exe 3828 svchost.exe 3828 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process Token: SeDebugPrivilege 3156 b2b4962fc5b8df755b981b8eee177ff2.exe Token: SeDebugPrivilege 3828 svchost.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exeb2b4962fc5b8df755b981b8eee177ff2.execmd.exesvchost.exesvchost.exedescription pid process target process PID 3156 wrote to memory of 692 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 692 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 692 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 3156 wrote to memory of 512 3156 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 512 wrote to memory of 2152 512 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 512 wrote to memory of 2152 512 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 512 wrote to memory of 2152 512 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 512 wrote to memory of 3828 512 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 512 wrote to memory of 3828 512 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 512 wrote to memory of 3828 512 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 2152 wrote to memory of 1768 2152 cmd.exe reg.exe PID 2152 wrote to memory of 1768 2152 cmd.exe reg.exe PID 2152 wrote to memory of 1768 2152 cmd.exe reg.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3828 wrote to memory of 3392 3828 svchost.exe svchost.exe PID 3392 wrote to memory of 2496 3392 svchost.exe cmd.exe PID 3392 wrote to memory of 2496 3392 svchost.exe cmd.exe PID 3392 wrote to memory of 2496 3392 svchost.exe cmd.exe PID 3392 wrote to memory of 2496 3392 svchost.exe cmd.exe PID 3392 wrote to memory of 2496 3392 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exeC:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exeC:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
memory/512-130-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/512-128-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/512-129-0x0000000000405E28-mapping.dmp
-
memory/1768-137-0x0000000000000000-mapping.dmp
-
memory/2152-131-0x0000000000000000-mapping.dmp
-
memory/2496-156-0x00000000005D0000-0x00000000005D1000-memory.dmpFilesize
4KB
-
memory/2496-155-0x0000000000000000-mapping.dmp
-
memory/3156-121-0x0000000006770000-0x0000000006771000-memory.dmpFilesize
4KB
-
memory/3156-127-0x0000000007100000-0x0000000007101000-memory.dmpFilesize
4KB
-
memory/3156-126-0x0000000007070000-0x00000000070D3000-memory.dmpFilesize
396KB
-
memory/3156-114-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/3156-120-0x0000000005170000-0x00000000051BC000-memory.dmpFilesize
304KB
-
memory/3156-119-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/3156-118-0x0000000004BB0000-0x0000000004BB1000-memory.dmpFilesize
4KB
-
memory/3156-117-0x0000000004BE0000-0x0000000004BE1000-memory.dmpFilesize
4KB
-
memory/3156-116-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/3392-151-0x0000000000405E28-mapping.dmp
-
memory/3392-154-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/3828-132-0x0000000000000000-mapping.dmp
-
memory/3828-140-0x0000000005600000-0x0000000005AFE000-memory.dmpFilesize
5.0MB