Analysis
- max time kernel
159s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
16/02/2022, 23:46
Static task
static1
Behavioral task
behavioral1
Sample
8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe
- Size 1.3MB
- Sample220216-3sbkaafgal
- SHA256 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3
- MD5 a95199c436b4effc05e3bb3121a9d923
- SHA1 bf63d159cf7099be93c82c0abaa5f4b7c8d49cbc
- SHA512 25bac734dabe76eb349a7d2199b9f17de364937a9fda0d6ac5c73cfd27ed9da355518c61af377fdfdd95e85319c2b0504728aa62b8b4be406c35f5e2154086b1
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
wealth.warzonedns.com:5202
Signatures
- NetWire RAT payload 9 IoCs
resource yara_rule behavioral2/files/0x000300000000072f-130.dat netwire behavioral2/files/0x000300000000072f-131.dat netwire behavioral2/files/0x000400000001629a-140.dat netwire behavioral2/files/0x000400000001629a-141.dat netwire behavioral2/files/0x000200000001e464-147.dat netwire behavioral2/files/0x000200000001e464-148.dat netwire behavioral2/files/0x000300000000072f-149.dat netwire behavioral2/files/0x000200000001e464-157.dat netwire behavioral2/files/0x000300000000072f-160.dat netwire - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 2 IoCs
resource yara_rule behavioral2/memory/4608-133-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4608-142-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat - Executes dropped EXE 5 IoCs
pid Process 1264 Blasthost.exe 2224 Host.exe 3412 RtDCpl64.exe 228 Blasthost.exe 4884 RtDCpl64.exe - Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4456 set thread context of 4608 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 84 PID 3412 set thread context of 4884 3412 RtDCpl64.exe 114 - autoit_exe 3 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000200000001e464-147.dat autoit_exe behavioral2/files/0x000200000001e464-148.dat autoit_exe behavioral2/files/0x000200000001e464-157.dat autoit_exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4300 schtasks.exe 1704 schtasks.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1360 svchost.exe Token: SeCreatePagefilePrivilege 1360 svchost.exe Token: SeShutdownPrivilege 1360 svchost.exe Token: SeCreatePagefilePrivilege 1360 svchost.exe Token: SeShutdownPrivilege 1360 svchost.exe Token: SeCreatePagefilePrivilege 1360 svchost.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe Token: SeRestorePrivilege 5060 TiWorker.exe Token: SeSecurityPrivilege 5060 TiWorker.exe Token: SeBackupPrivilege 5060 TiWorker.exe - Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 4456 wrote to memory of 1264 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 82 PID 4456 wrote to memory of 1264 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 82 PID 4456 wrote to memory of 1264 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 82 PID 4456 wrote to memory of 4608 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 84 PID 4456 wrote to memory of 4608 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 84 PID 4456 wrote to memory of 4608 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 84 PID 4456 wrote to memory of 4608 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 84 PID 4456 wrote to memory of 4608 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 84 PID 1264 wrote to memory of 2224 1264 Blasthost.exe 85 PID 1264 wrote to memory of 2224 1264 Blasthost.exe 85 PID 1264 wrote to memory of 2224 1264 Blasthost.exe 85 PID 4608 wrote to memory of 4780 4608 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 86 PID 4608 wrote to memory of 4780 4608 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 86 PID 4608 wrote to memory of 4780 4608 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 86 PID 4456 wrote to memory of 4300 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 88 PID 4456 wrote to memory of 4300 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 88 PID 4456 wrote to memory of 4300 4456 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 88 PID 4608 wrote to memory of 4780 4608 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 86 PID 4608 wrote to memory of 4780 4608 8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe 86 PID 3412 wrote to memory of 228 3412 RtDCpl64.exe 113 PID 3412 wrote to memory of 228 3412 RtDCpl64.exe 113 PID 3412 wrote to memory of 228 3412 RtDCpl64.exe 113 PID 3412 wrote to memory of 4884 3412 RtDCpl64.exe 114 PID 3412 wrote to memory of 4884 3412 RtDCpl64.exe 114 PID 3412 wrote to memory of 4884 3412 RtDCpl64.exe 114 PID 3412 wrote to memory of 4884 3412 RtDCpl64.exe 114 PID 3412 wrote to memory of 4884 3412 RtDCpl64.exe 114 PID 4884 wrote to memory of 3104 4884 RtDCpl64.exe 115 PID 4884 wrote to memory of 3104 4884 RtDCpl64.exe 115 PID 4884 wrote to memory of 3104 4884 RtDCpl64.exe 115 PID 3412 wrote to memory of 1704 3412 RtDCpl64.exe 117 PID 3412 wrote to memory of 1704 3412 RtDCpl64.exe 117 PID 3412 wrote to memory of 1704 3412 RtDCpl64.exe 117 PID 4884 wrote to memory of 3104 4884 RtDCpl64.exe 115 PID 4884 wrote to memory of 3104 4884 RtDCpl64.exe 115
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe"C:\Users\Admin\AppData\Local\Temp\8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4456 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2224
-
-
-
C:\Users\Admin\AppData\Local\Temp\8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe"C:\Users\Admin\AppData\Local\Temp\8e08c3897aa125f0228ed5ff31a14b8a1a7296d6a482cbcec7e39201cb6871b3.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:4780
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4300
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1360
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:5060
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:228
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:3104
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1704
-