Analysis
-
max time kernel
133s -
max time network
174s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-07-2021 15:30
Static task
static1
Behavioral task
behavioral1
Sample
391c3bc7f5534306976f645db21ff085.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
391c3bc7f5534306976f645db21ff085.exe
Resource
win10v20210410
General
-
Target
391c3bc7f5534306976f645db21ff085.exe
-
Size
473KB
-
MD5
391c3bc7f5534306976f645db21ff085
-
SHA1
4b20940c605a93eef2de9853a180431165e7e16d
-
SHA256
0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
-
SHA512
762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
Malware Config
Extracted
warzonerat
ghjklhgteg.strangled.net:6703
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 1476 images.exe 1500 images.exe -
Loads dropped DLL 2 IoCs
Processes:
391c3bc7f5534306976f645db21ff085.exeimages.exepid process 1172 391c3bc7f5534306976f645db21ff085.exe 1476 images.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
391c3bc7f5534306976f645db21ff085.exeimages.exedescription pid process target process PID 1652 set thread context of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1476 set thread context of 1500 1476 images.exe images.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
391c3bc7f5534306976f645db21ff085.exeimages.exepid process 1652 391c3bc7f5534306976f645db21ff085.exe 1652 391c3bc7f5534306976f645db21ff085.exe 1476 images.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
391c3bc7f5534306976f645db21ff085.exeimages.exedescription pid process Token: SeDebugPrivilege 1652 391c3bc7f5534306976f645db21ff085.exe Token: SeDebugPrivilege 1476 images.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
391c3bc7f5534306976f645db21ff085.exe391c3bc7f5534306976f645db21ff085.exeimages.exeimages.exedescription pid process target process PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1652 wrote to memory of 1172 1652 391c3bc7f5534306976f645db21ff085.exe 391c3bc7f5534306976f645db21ff085.exe PID 1172 wrote to memory of 1476 1172 391c3bc7f5534306976f645db21ff085.exe images.exe PID 1172 wrote to memory of 1476 1172 391c3bc7f5534306976f645db21ff085.exe images.exe PID 1172 wrote to memory of 1476 1172 391c3bc7f5534306976f645db21ff085.exe images.exe PID 1172 wrote to memory of 1476 1172 391c3bc7f5534306976f645db21ff085.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1476 wrote to memory of 1500 1476 images.exe images.exe PID 1500 wrote to memory of 904 1500 images.exe cmd.exe PID 1500 wrote to memory of 904 1500 images.exe cmd.exe PID 1500 wrote to memory of 904 1500 images.exe cmd.exe PID 1500 wrote to memory of 904 1500 images.exe cmd.exe PID 1500 wrote to memory of 904 1500 images.exe cmd.exe PID 1500 wrote to memory of 904 1500 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe"C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exeC:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\images.exeC:\Users\Admin\AppData\Local\Temp\images.exe4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeMD5
391c3bc7f5534306976f645db21ff085
SHA14b20940c605a93eef2de9853a180431165e7e16d
SHA2560618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
SHA512762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
-
C:\ProgramData\images.exeMD5
391c3bc7f5534306976f645db21ff085
SHA14b20940c605a93eef2de9853a180431165e7e16d
SHA2560618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
SHA512762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
-
C:\Users\Admin\AppData\Local\Temp\images.exeMD5
391c3bc7f5534306976f645db21ff085
SHA14b20940c605a93eef2de9853a180431165e7e16d
SHA2560618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
SHA512762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
-
C:\Users\Admin\AppData\Local\Temp\images.exeMD5
391c3bc7f5534306976f645db21ff085
SHA14b20940c605a93eef2de9853a180431165e7e16d
SHA2560618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
SHA512762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
-
\ProgramData\images.exeMD5
391c3bc7f5534306976f645db21ff085
SHA14b20940c605a93eef2de9853a180431165e7e16d
SHA2560618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
SHA512762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
-
\Users\Admin\AppData\Local\Temp\images.exeMD5
391c3bc7f5534306976f645db21ff085
SHA14b20940c605a93eef2de9853a180431165e7e16d
SHA2560618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
SHA512762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
-
memory/904-98-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/904-97-0x0000000000000000-mapping.dmp
-
memory/1172-74-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-71-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1172-73-0x0000000076641000-0x0000000076643000-memory.dmpFilesize
8KB
-
memory/1172-72-0x0000000000405E28-mapping.dmp
-
memory/1476-76-0x0000000000000000-mapping.dmp
-
memory/1476-79-0x0000000000120000-0x0000000000121000-memory.dmpFilesize
4KB
-
memory/1476-82-0x0000000000701000-0x0000000000702000-memory.dmpFilesize
4KB
-
memory/1476-81-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/1476-83-0x0000000000706000-0x0000000000717000-memory.dmpFilesize
68KB
-
memory/1500-92-0x0000000000405E28-mapping.dmp
-
memory/1500-95-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/1652-70-0x00000000080A0000-0x0000000008113000-memory.dmpFilesize
460KB
-
memory/1652-63-0x0000000004DD1000-0x0000000004DD2000-memory.dmpFilesize
4KB
-
memory/1652-60-0x0000000001260000-0x0000000001261000-memory.dmpFilesize
4KB
-
memory/1652-62-0x0000000004DD0000-0x0000000004DD1000-memory.dmpFilesize
4KB
-
memory/1652-64-0x0000000004DD6000-0x0000000004DE7000-memory.dmpFilesize
68KB
-
memory/1652-65-0x0000000001000000-0x0000000001052000-memory.dmpFilesize
328KB