Analysis
-
max time kernel
139s -
max time network
157s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-07-2021 16:03
Static task
static1
Behavioral task
behavioral1
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
b2b4962fc5b8df755b981b8eee177ff2.exe
Resource
win10v20210408
General
-
Target
b2b4962fc5b8df755b981b8eee177ff2.exe
-
Size
643KB
-
MD5
b2b4962fc5b8df755b981b8eee177ff2
-
SHA1
9c0c8898c17c1288bc3edf0b44b2309c5dabd68c
-
SHA256
3eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
-
SHA512
59651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
Malware Config
Extracted
warzonerat
byx.z86.ru:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exesvchost.exepid process 744 svchost.exe 1832 svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process target process PID 4796 set thread context of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 744 set thread context of 1832 744 svchost.exe svchost.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exepid process 4796 b2b4962fc5b8df755b981b8eee177ff2.exe 4796 b2b4962fc5b8df755b981b8eee177ff2.exe 744 svchost.exe 744 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exesvchost.exedescription pid process Token: SeDebugPrivilege 4796 b2b4962fc5b8df755b981b8eee177ff2.exe Token: SeDebugPrivilege 744 svchost.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
b2b4962fc5b8df755b981b8eee177ff2.exeb2b4962fc5b8df755b981b8eee177ff2.execmd.exesvchost.exesvchost.exedescription pid process target process PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 4796 wrote to memory of 804 4796 b2b4962fc5b8df755b981b8eee177ff2.exe b2b4962fc5b8df755b981b8eee177ff2.exe PID 804 wrote to memory of 476 804 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 804 wrote to memory of 476 804 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 804 wrote to memory of 476 804 b2b4962fc5b8df755b981b8eee177ff2.exe cmd.exe PID 804 wrote to memory of 744 804 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 804 wrote to memory of 744 804 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 804 wrote to memory of 744 804 b2b4962fc5b8df755b981b8eee177ff2.exe svchost.exe PID 476 wrote to memory of 1412 476 cmd.exe reg.exe PID 476 wrote to memory of 1412 476 cmd.exe reg.exe PID 476 wrote to memory of 1412 476 cmd.exe reg.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 744 wrote to memory of 1832 744 svchost.exe svchost.exe PID 1832 wrote to memory of 2220 1832 svchost.exe cmd.exe PID 1832 wrote to memory of 2220 1832 svchost.exe cmd.exe PID 1832 wrote to memory of 2220 1832 svchost.exe cmd.exe PID 1832 wrote to memory of 2220 1832 svchost.exe cmd.exe PID 1832 wrote to memory of 2220 1832 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exeC:\Users\Admin\AppData\Local\Temp\b2b4962fc5b8df755b981b8eee177ff2.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"4⤵
-
C:\ProgramData\svchost.exe"C:\ProgramData\svchost.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\ProgramData\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeMD5
b2b4962fc5b8df755b981b8eee177ff2
SHA19c0c8898c17c1288bc3edf0b44b2309c5dabd68c
SHA2563eeb2e2ce79a4ef273dd4abf33b96be6131d0bc519bcd96b9fe5aafbd504bc59
SHA51259651fc36073dfd27eaec63e9afaf98d5b18f6f187e5c1534e79911b851d84155949e77a558a46917b2ef687b540f04ea4a6a5b9a0fadce039c35a8a5ff54be7
-
memory/476-131-0x0000000000000000-mapping.dmp
-
memory/744-141-0x0000000005200000-0x00000000056FE000-memory.dmpFilesize
5.0MB
-
memory/744-132-0x0000000000000000-mapping.dmp
-
memory/804-129-0x0000000000405E28-mapping.dmp
-
memory/804-128-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/804-130-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1412-139-0x0000000000000000-mapping.dmp
-
memory/1832-151-0x0000000000405E28-mapping.dmp
-
memory/2220-155-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2220-154-0x0000000000000000-mapping.dmp
-
memory/4796-120-0x0000000005E20000-0x0000000005E6C000-memory.dmpFilesize
304KB
-
memory/4796-119-0x0000000005A90000-0x0000000005A91000-memory.dmpFilesize
4KB
-
memory/4796-127-0x0000000007E80000-0x0000000007E81000-memory.dmpFilesize
4KB
-
memory/4796-118-0x00000000059A0000-0x0000000005E9E000-memory.dmpFilesize
5.0MB
-
memory/4796-121-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/4796-117-0x00000000059A0000-0x00000000059A1000-memory.dmpFilesize
4KB
-
memory/4796-116-0x0000000005EA0000-0x0000000005EA1000-memory.dmpFilesize
4KB
-
memory/4796-126-0x0000000007DF0000-0x0000000007E53000-memory.dmpFilesize
396KB
-
memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB