Analysis
-
max time kernel
127s -
max time network
165s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
20-07-2021 16:03
Static task
static1
Behavioral task
behavioral1
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win10v20210408
General
-
Target
b2b4962fc5b8df755b981b8eee177ff2.exe
-
Size
643KB
-
MD5
b2b4962fc5b8df755b981b8eee177ff2
-
SHA1
9c0c8898c17c1288bc3edf0b44b2309c5dabd68c
-
SHA256
3eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
-
SHA512
59651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 852 svchost.exe 328 svchost.exe -
Loads dropped DLL 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exepid process 1760 b2b4962fc5b8df755b981b8eee177ff2.exe 852 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process target process PID 1852 set thread context of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 852 set thread context of 328 852 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exepid process 1852 b2b4962fc5b8df755b981b8eee177ff2.exe 1852 b2b4962fc5b8df755b981b8eee177ff2.exe 852 svchost.exe 852 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process Token: SeDebugPrivilege 1852 b2b4962fc5b8df755b981b8eee177ff2.exe Token: SeDebugPrivilege 852 svchost.exe -
Suspicious use of WriteProcessMemory 40 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exeb2b4962fc5b8df755b981b8eee177ff2.execmd.exesvchost.exesvchost.exedescription pid process target process PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1852 wrote to memory of 1760 1852 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 1760 wrote to memory of 888 1760 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 1760 wrote to memory of 888 1760 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 1760 wrote to memory of 888 1760 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 1760 wrote to memory of 888 1760 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 1760 wrote to memory of 852 1760 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 1760 wrote to memory of 852 1760 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 1760 wrote to memory of 852 1760 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 1760 wrote to memory of 852 1760 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 888 wrote to memory of 860 888 cmd.exe reg.exe PID 888 wrote to memory of 860 888 cmd.exe reg.exe PID 888 wrote to memory of 860 888 cmd.exe reg.exe PID 888 wrote to memory of 860 888 cmd.exe reg.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 852 wrote to memory of 328 852 svchost.exe svchost.exe PID 328 wrote to memory of 864 328 svchost.exe cmd.exe PID 328 wrote to memory of 864 328 svchost.exe cmd.exe PID 328 wrote to memory of 864 328 svchost.exe cmd.exe PID 328 wrote to memory of 864 328 svchost.exe cmd.exe PID 328 wrote to memory of 864 328 svchost.exe cmd.exe PID 328 wrote to memory of 864 328 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exeC:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
memory/328-92-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/328-89-0x0000000000405E28-mapping.dmp
-
memory/852-80-0x0000000004D50000-0x0000000004D51000-memory.dmpFilesize
4KB
-
memory/852-74-0x0000000000000000-mapping.dmp
-
memory/852-77-0x0000000000C50000-0x0000000000C51000-memory.dmpFilesize
4KB
-
memory/860-79-0x0000000000000000-mapping.dmp
-
memory/864-94-0x0000000000000000-mapping.dmp
-
memory/864-95-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/888-72-0x0000000000000000-mapping.dmp
-
memory/1760-71-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1760-70-0x0000000074F31000-0x0000000074F33000-memory.dmpFilesize
8KB
-
memory/1760-69-0x0000000000405E28-mapping.dmp
-
memory/1760-68-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1852-59-0x00000000011D0000-0x00000000011D1000-memory.dmpFilesize
4KB
-
memory/1852-61-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/1852-62-0x00000000005D0000-0x000000000061C000-memory.dmpFilesize
304KB
-
memory/1852-67-0x0000000004F00000-0x0000000004F63000-memory.dmpFilesize
396KB