Analysis
-
max time kernel
161s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17/02/2022, 00:10
Behavioral task
behavioral1
Sample
80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe
Resource
win10v2004-en-20220113
General
-
Target
80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe
-
Size
1.3MB
-
MD5
297bcd581fb60d9683ccbc0570594803
-
SHA1
523bcedf527675e2495a029c428b77585ba08764
-
SHA256
80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9
-
SHA512
c22de26467c8f971668cf81e485e3872c5cf8f75bfa794e37a5044957473681efe79b99617272bd24e6e39c057cfc481c491b5d2585f9b13ab3aa570c0e2d793
Malware Config
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 12 IoCs
resource yara_rule behavioral2/files/0x000400000001e789-133.dat netwire behavioral2/files/0x000400000001e789-134.dat netwire behavioral2/files/0x000400000001e722-135.dat netwire behavioral2/files/0x000400000001e722-136.dat netwire behavioral2/files/0x000300000001e78d-150.dat netwire behavioral2/files/0x000300000001e78d-151.dat netwire behavioral2/files/0x000400000001e789-152.dat netwire behavioral2/files/0x000300000001e78d-160.dat netwire behavioral2/files/0x000400000001e789-164.dat netwire behavioral2/files/0x000300000001e78d-165.dat netwire behavioral2/files/0x000400000001e789-166.dat netwire behavioral2/files/0x000300000001e78d-174.dat netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 2 IoCs
resource yara_rule behavioral2/memory/3468-138-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/3468-145-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Executes dropped EXE 8 IoCs
pid Process 1236 Blasthost.exe 1776 Host.exe 2864 RtDCpl64.exe 2192 Blasthost.exe 696 RtDCpl64.exe 3652 RtDCpl64.exe 3312 Blasthost.exe 2504 RtDCpl64.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1836 set thread context of 3468 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 86 PID 2864 set thread context of 696 2864 RtDCpl64.exe 108 PID 3652 set thread context of 2504 3652 RtDCpl64.exe 120 -
autoit_exe 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000300000001e78d-150.dat autoit_exe behavioral2/files/0x000300000001e78d-151.dat autoit_exe behavioral2/files/0x000300000001e78d-160.dat autoit_exe behavioral2/files/0x000300000001e78d-165.dat autoit_exe behavioral2/files/0x000300000001e78d-174.dat autoit_exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2436 schtasks.exe 2396 schtasks.exe 2620 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3924 svchost.exe Token: SeCreatePagefilePrivilege 3924 svchost.exe Token: SeShutdownPrivilege 3924 svchost.exe Token: SeCreatePagefilePrivilege 3924 svchost.exe Token: SeShutdownPrivilege 3924 svchost.exe Token: SeCreatePagefilePrivilege 3924 svchost.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe Token: SeRestorePrivilege 1948 TiWorker.exe Token: SeSecurityPrivilege 1948 TiWorker.exe Token: SeBackupPrivilege 1948 TiWorker.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1836 wrote to memory of 1236 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 83 PID 1836 wrote to memory of 1236 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 83 PID 1836 wrote to memory of 1236 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 83 PID 1236 wrote to memory of 1776 1236 Blasthost.exe 85 PID 1236 wrote to memory of 1776 1236 Blasthost.exe 85 PID 1236 wrote to memory of 1776 1236 Blasthost.exe 85 PID 1836 wrote to memory of 3468 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 86 PID 1836 wrote to memory of 3468 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 86 PID 1836 wrote to memory of 3468 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 86 PID 1836 wrote to memory of 3468 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 86 PID 1836 wrote to memory of 3468 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 86 PID 3468 wrote to memory of 1588 3468 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 87 PID 3468 wrote to memory of 1588 3468 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 87 PID 3468 wrote to memory of 1588 3468 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 87 PID 1836 wrote to memory of 2620 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 90 PID 1836 wrote to memory of 2620 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 90 PID 1836 wrote to memory of 2620 1836 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 90 PID 3468 wrote to memory of 1588 3468 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 87 PID 3468 wrote to memory of 1588 3468 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe 87 PID 2864 wrote to memory of 2192 2864 RtDCpl64.exe 107 PID 2864 wrote to memory of 2192 2864 RtDCpl64.exe 107 PID 2864 wrote to memory of 2192 2864 RtDCpl64.exe 107 PID 2864 wrote to memory of 696 2864 RtDCpl64.exe 108 PID 2864 wrote to memory of 696 2864 RtDCpl64.exe 108 PID 2864 wrote to memory of 696 2864 RtDCpl64.exe 108 PID 2864 wrote to memory of 696 2864 RtDCpl64.exe 108 PID 2864 wrote to memory of 696 2864 RtDCpl64.exe 108 PID 696 wrote to memory of 640 696 RtDCpl64.exe 109 PID 696 wrote to memory of 640 696 RtDCpl64.exe 109 PID 696 wrote to memory of 640 696 RtDCpl64.exe 109 PID 2864 wrote to memory of 2436 2864 RtDCpl64.exe 111 PID 2864 wrote to memory of 2436 2864 RtDCpl64.exe 111 PID 2864 wrote to memory of 2436 2864 RtDCpl64.exe 111 PID 696 wrote to memory of 640 696 RtDCpl64.exe 109 PID 696 wrote to memory of 640 696 RtDCpl64.exe 109 PID 3652 wrote to memory of 3312 3652 RtDCpl64.exe 119 PID 3652 wrote to memory of 3312 3652 RtDCpl64.exe 119 PID 3652 wrote to memory of 3312 3652 RtDCpl64.exe 119 PID 3652 wrote to memory of 2504 3652 RtDCpl64.exe 120 PID 3652 wrote to memory of 2504 3652 RtDCpl64.exe 120 PID 3652 wrote to memory of 2504 3652 RtDCpl64.exe 120 PID 3652 wrote to memory of 2504 3652 RtDCpl64.exe 120 PID 3652 wrote to memory of 2504 3652 RtDCpl64.exe 120 PID 2504 wrote to memory of 1820 2504 RtDCpl64.exe 121 PID 2504 wrote to memory of 1820 2504 RtDCpl64.exe 121 PID 2504 wrote to memory of 1820 2504 RtDCpl64.exe 121 PID 3652 wrote to memory of 2396 3652 RtDCpl64.exe 123 PID 3652 wrote to memory of 2396 3652 RtDCpl64.exe 123 PID 3652 wrote to memory of 2396 3652 RtDCpl64.exe 123 PID 2504 wrote to memory of 1820 2504 RtDCpl64.exe 121 PID 2504 wrote to memory of 1820 2504 RtDCpl64.exe 121
Processes
-
C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1836 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:1776
-
-
-
C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1588
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2620
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3924
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:2192
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:696 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:640
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2436
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:3312
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1820
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2396
-