Analysis
-
max time kernel
52s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 06:58
Static task
static1
Behavioral task
behavioral1
Sample
3b377d022762ca91179f7f9ccd69d567.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
3b377d022762ca91179f7f9ccd69d567.exe
Resource
win10-en
General
-
Target
3b377d022762ca91179f7f9ccd69d567.exe
-
Size
819KB
-
MD5
3b377d022762ca91179f7f9ccd69d567
-
SHA1
f6a8d47a3379bd0ac2cd96782ba3f7040045d5d9
-
SHA256
8ec53980cf686b472cfce52d0dc99a86ec328f2c596714b7c0468d957248ff36
-
SHA512
ac9210b72f873f2974304acea681c80d4ea24f4752f2376a1f5c6a9f9aed91264c97af31e5370a4efb8dcd5e4f8b96c601c6f972af4e8a851a77c68c3cfe9923
Malware Config
Extracted
warzonerat
engkaa.ddns.net:4545
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/916-66-0x0000000000405CE2-mapping.dmp warzonerat behavioral1/memory/916-65-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/916-68-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 824 cmd.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
3b377d022762ca91179f7f9ccd69d567.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\Cymkfzk = "C:\\Users\\Public\\Libraries\\kzfkmyC.url" 3b377d022762ca91179f7f9ccd69d567.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
3b377d022762ca91179f7f9ccd69d567.exedescription pid process target process PID 1640 set thread context of 916 1640 3b377d022762ca91179f7f9ccd69d567.exe 3b377d022762ca91179f7f9ccd69d567.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
3b377d022762ca91179f7f9ccd69d567.exe3b377d022762ca91179f7f9ccd69d567.execmd.exedescription pid process target process PID 1640 wrote to memory of 916 1640 3b377d022762ca91179f7f9ccd69d567.exe 3b377d022762ca91179f7f9ccd69d567.exe PID 1640 wrote to memory of 916 1640 3b377d022762ca91179f7f9ccd69d567.exe 3b377d022762ca91179f7f9ccd69d567.exe PID 1640 wrote to memory of 916 1640 3b377d022762ca91179f7f9ccd69d567.exe 3b377d022762ca91179f7f9ccd69d567.exe PID 1640 wrote to memory of 916 1640 3b377d022762ca91179f7f9ccd69d567.exe 3b377d022762ca91179f7f9ccd69d567.exe PID 1640 wrote to memory of 916 1640 3b377d022762ca91179f7f9ccd69d567.exe 3b377d022762ca91179f7f9ccd69d567.exe PID 1640 wrote to memory of 916 1640 3b377d022762ca91179f7f9ccd69d567.exe 3b377d022762ca91179f7f9ccd69d567.exe PID 916 wrote to memory of 824 916 3b377d022762ca91179f7f9ccd69d567.exe cmd.exe PID 916 wrote to memory of 824 916 3b377d022762ca91179f7f9ccd69d567.exe cmd.exe PID 916 wrote to memory of 824 916 3b377d022762ca91179f7f9ccd69d567.exe cmd.exe PID 916 wrote to memory of 824 916 3b377d022762ca91179f7f9ccd69d567.exe cmd.exe PID 824 wrote to memory of 2016 824 cmd.exe PING.EXE PID 824 wrote to memory of 2016 824 cmd.exe PING.EXE PID 824 wrote to memory of 2016 824 cmd.exe PING.EXE PID 824 wrote to memory of 2016 824 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b377d022762ca91179f7f9ccd69d567.exe"C:\Users\Admin\AppData\Local\Temp\3b377d022762ca91179f7f9ccd69d567.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3b377d022762ca91179f7f9ccd69d567.exeC:\Users\Admin\AppData\Local\Temp\3b377d022762ca91179f7f9ccd69d567.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C ping 1.2.3.4 -n 2 -w 1000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\3b377d022762ca91179f7f9ccd69d567.exe"3⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 1.2.3.4 -n 2 -w 10004⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/824-70-0x0000000000000000-mapping.dmp
-
memory/916-66-0x0000000000405CE2-mapping.dmp
-
memory/916-65-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/916-68-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/916-69-0x00000000037A0000-0x0000000003824000-memory.dmpFilesize
528KB
-
memory/1640-60-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/1640-64-0x0000000075041000-0x0000000075043000-memory.dmpFilesize
8KB
-
memory/2016-71-0x0000000000000000-mapping.dmp