Analysis
- max time kernel
156s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
16/02/2022, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe
- Size 1.3MB
- Sample220216-313nqsfhal
- SHA256 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0
- MD5 07cc9638a63c64754d88cf0d9cd99a78
- SHA1 21ac6ff4fa45fe785361d1d35db0c7de3c127a1a
- SHA512 f272d3041ce43efbf1034d4b1d150a7b4ffa690c7160567919c97cf3037226a677206efd471161f69c913dfc7ade8cfba16d2c4d45e3e7de703968bd05f02c1f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
wealth.warzonedns.com:5202
Signatures
- NetWire RAT payload 12 IoCs
resource yara_rule behavioral2/files/0x000400000001e7c2-130.dat netwire behavioral2/files/0x000400000001e7c2-131.dat netwire behavioral2/files/0x000400000001e7c5-141.dat netwire behavioral2/files/0x000400000001e7c5-142.dat netwire behavioral2/files/0x000600000001e7c7-144.dat netwire behavioral2/files/0x000600000001e7c7-145.dat netwire behavioral2/files/0x000400000001e7c2-146.dat netwire behavioral2/files/0x000600000001e7c7-154.dat netwire behavioral2/files/0x000400000001e7c2-161.dat netwire behavioral2/files/0x000600000001e7c7-162.dat netwire behavioral2/files/0x000400000001e7c2-163.dat netwire behavioral2/files/0x000600000001e7c7-171.dat netwire - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 2 IoCs
resource yara_rule behavioral2/memory/4700-133-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4700-140-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat - Executes dropped EXE 8 IoCs
pid Process 3192 Blasthost.exe 4548 Host.exe 4852 RtDCpl64.exe 2300 Blasthost.exe 2996 RtDCpl64.exe 1856 RtDCpl64.exe 4648 Blasthost.exe 4988 RtDCpl64.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4768 set thread context of 4700 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 84 PID 4852 set thread context of 2996 4852 RtDCpl64.exe 102 PID 1856 set thread context of 4988 1856 RtDCpl64.exe 121 - autoit_exe 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000600000001e7c7-144.dat autoit_exe behavioral2/files/0x000600000001e7c7-145.dat autoit_exe behavioral2/files/0x000600000001e7c7-154.dat autoit_exe behavioral2/files/0x000600000001e7c7-162.dat autoit_exe behavioral2/files/0x000600000001e7c7-171.dat autoit_exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4764 schtasks.exe 4008 schtasks.exe 2332 schtasks.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4892 svchost.exe Token: SeCreatePagefilePrivilege 4892 svchost.exe Token: SeShutdownPrivilege 4892 svchost.exe Token: SeCreatePagefilePrivilege 4892 svchost.exe Token: SeShutdownPrivilege 4892 svchost.exe Token: SeCreatePagefilePrivilege 4892 svchost.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe Token: SeRestorePrivilege 3984 TiWorker.exe Token: SeSecurityPrivilege 3984 TiWorker.exe Token: SeBackupPrivilege 3984 TiWorker.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 4768 wrote to memory of 3192 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 82 PID 4768 wrote to memory of 3192 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 82 PID 4768 wrote to memory of 3192 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 82 PID 4768 wrote to memory of 4700 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 84 PID 4768 wrote to memory of 4700 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 84 PID 4768 wrote to memory of 4700 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 84 PID 4768 wrote to memory of 4700 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 84 PID 4768 wrote to memory of 4700 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 84 PID 3192 wrote to memory of 4548 3192 Blasthost.exe 85 PID 3192 wrote to memory of 4548 3192 Blasthost.exe 85 PID 3192 wrote to memory of 4548 3192 Blasthost.exe 85 PID 4768 wrote to memory of 4764 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 86 PID 4768 wrote to memory of 4764 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 86 PID 4768 wrote to memory of 4764 4768 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 86 PID 4700 wrote to memory of 4664 4700 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 88 PID 4700 wrote to memory of 4664 4700 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 88 PID 4700 wrote to memory of 4664 4700 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 88 PID 4700 wrote to memory of 4664 4700 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 88 PID 4700 wrote to memory of 4664 4700 86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe 88 PID 4852 wrote to memory of 2300 4852 RtDCpl64.exe 101 PID 4852 wrote to memory of 2300 4852 RtDCpl64.exe 101 PID 4852 wrote to memory of 2300 4852 RtDCpl64.exe 101 PID 4852 wrote to memory of 2996 4852 RtDCpl64.exe 102 PID 4852 wrote to memory of 2996 4852 RtDCpl64.exe 102 PID 4852 wrote to memory of 2996 4852 RtDCpl64.exe 102 PID 4852 wrote to memory of 2996 4852 RtDCpl64.exe 102 PID 4852 wrote to memory of 2996 4852 RtDCpl64.exe 102 PID 2996 wrote to memory of 1900 2996 RtDCpl64.exe 103 PID 2996 wrote to memory of 1900 2996 RtDCpl64.exe 103 PID 2996 wrote to memory of 1900 2996 RtDCpl64.exe 103 PID 4852 wrote to memory of 4008 4852 RtDCpl64.exe 105 PID 4852 wrote to memory of 4008 4852 RtDCpl64.exe 105 PID 4852 wrote to memory of 4008 4852 RtDCpl64.exe 105 PID 2996 wrote to memory of 1900 2996 RtDCpl64.exe 103 PID 2996 wrote to memory of 1900 2996 RtDCpl64.exe 103 PID 1856 wrote to memory of 4648 1856 RtDCpl64.exe 120 PID 1856 wrote to memory of 4648 1856 RtDCpl64.exe 120 PID 1856 wrote to memory of 4648 1856 RtDCpl64.exe 120 PID 1856 wrote to memory of 4988 1856 RtDCpl64.exe 121 PID 1856 wrote to memory of 4988 1856 RtDCpl64.exe 121 PID 1856 wrote to memory of 4988 1856 RtDCpl64.exe 121 PID 1856 wrote to memory of 4988 1856 RtDCpl64.exe 121 PID 1856 wrote to memory of 4988 1856 RtDCpl64.exe 121 PID 4988 wrote to memory of 4208 4988 RtDCpl64.exe 122 PID 4988 wrote to memory of 4208 4988 RtDCpl64.exe 122 PID 4988 wrote to memory of 4208 4988 RtDCpl64.exe 122 PID 1856 wrote to memory of 2332 1856 RtDCpl64.exe 124 PID 1856 wrote to memory of 2332 1856 RtDCpl64.exe 124 PID 1856 wrote to memory of 2332 1856 RtDCpl64.exe 124 PID 4988 wrote to memory of 4208 4988 RtDCpl64.exe 122 PID 4988 wrote to memory of 4208 4988 RtDCpl64.exe 122
Processes
-
C:\Users\Admin\AppData\Local\Temp\86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe"C:\Users\Admin\AppData\Local\Temp\86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:4548
-
-
-
C:\Users\Admin\AppData\Local\Temp\86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe"C:\Users\Admin\AppData\Local\Temp\86fb1a8cdd439c7e3688d648eefd069f70c3fca80b0d255d4cf69d1d09734ec0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4700 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:4664
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4764
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:2300
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2996 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1900
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4008
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4892
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3984
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:4648
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:4208
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2332
-