Analysis Overview
SHA256
80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9
Threat Level: Known bad
The file 80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9 was found to be: Known bad.
Malicious Activity Summary
WarzoneRat, AveMaria
Netwire family
Netwire
NetWire RAT payload
Warzone RAT Payload
Executes dropped EXE
Checks computer location settings
Loads dropped DLL
autoit_exe
Suspicious use of SetThreadContext
Drops file in Windows directory
Enumerates physical storage devices
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Creates scheduled task(s)
MITRE ATT&CK
Enterprise Matrix V6
Analysis: static1
Detonation Overview
Reported
2022-02-17 00:10
Signatures
NetWire RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Netwire family
autoit_exe
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2022-02-17 00:10
Reported
2022-02-17 00:24
Platform
win7-en-20211208
Max time kernel
151s
Max time network
135s
Command Line
Signatures
NetWire RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Netwire
WarzoneRat, AveMaria
Warzone RAT Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Blasthost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Blasthost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Blasthost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
Loads dropped DLL
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1724 set thread context of 1372 | N/A | C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe | C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe |
| PID 972 set thread context of 544 | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe |
| PID 1756 set thread context of 1588 | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe |
autoit_exe
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe
"C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"
C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe
"C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\system32\taskeng.exe
taskeng.exe {98866C48-1C07-4333-9315-3911C146C122} S-1-5-21-3846991908-3261386348-1409841751-1000:VQVVOAJK\Admin:Interactive:[1]
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
Files
memory/1724-54-0x0000000076C91000-0x0000000076C93000-memory.dmp
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Imgburn\Host.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Imgburn\Host.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
memory/1372-66-0x0000000000080000-0x000000000009D000-memory.dmp
memory/1372-67-0x0000000000080000-0x000000000009D000-memory.dmp
memory/1724-75-0x0000000000550000-0x0000000000551000-memory.dmp
memory/1372-76-0x0000000000080000-0x000000000009D000-memory.dmp
memory/728-77-0x00000000000B0000-0x00000000000B1000-memory.dmp
memory/728-78-0x00000000000B0000-0x00000000000B1000-memory.dmp
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | 5469f50cb7a66219b861c9e19313f003 |
| SHA1 | 9f3d63ac89607b6b82ffb4462d2346bcf41c2e40 |
| SHA256 | 41f742c8adc7f1196f65b91ea211497941cba999ca515c08b3c99306c0e7c257 |
| SHA512 | 93b64bd8bdfc355e5c824c53d645be1b6dc26be584705b32588492f828d4e66a0791eedf3f8be04047fec04f315e55515929f9646bd1f4408d58e66c7e93ebbf |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | 5469f50cb7a66219b861c9e19313f003 |
| SHA1 | 9f3d63ac89607b6b82ffb4462d2346bcf41c2e40 |
| SHA256 | 41f742c8adc7f1196f65b91ea211497941cba999ca515c08b3c99306c0e7c257 |
| SHA512 | 93b64bd8bdfc355e5c824c53d645be1b6dc26be584705b32588492f828d4e66a0791eedf3f8be04047fec04f315e55515929f9646bd1f4408d58e66c7e93ebbf |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | 5469f50cb7a66219b861c9e19313f003 |
| SHA1 | 9f3d63ac89607b6b82ffb4462d2346bcf41c2e40 |
| SHA256 | 41f742c8adc7f1196f65b91ea211497941cba999ca515c08b3c99306c0e7c257 |
| SHA512 | 93b64bd8bdfc355e5c824c53d645be1b6dc26be584705b32588492f828d4e66a0791eedf3f8be04047fec04f315e55515929f9646bd1f4408d58e66c7e93ebbf |
memory/1900-102-0x0000000000120000-0x0000000000121000-memory.dmp
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | 5469f50cb7a66219b861c9e19313f003 |
| SHA1 | 9f3d63ac89607b6b82ffb4462d2346bcf41c2e40 |
| SHA256 | 41f742c8adc7f1196f65b91ea211497941cba999ca515c08b3c99306c0e7c257 |
| SHA512 | 93b64bd8bdfc355e5c824c53d645be1b6dc26be584705b32588492f828d4e66a0791eedf3f8be04047fec04f315e55515929f9646bd1f4408d58e66c7e93ebbf |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | 5469f50cb7a66219b861c9e19313f003 |
| SHA1 | 9f3d63ac89607b6b82ffb4462d2346bcf41c2e40 |
| SHA256 | 41f742c8adc7f1196f65b91ea211497941cba999ca515c08b3c99306c0e7c257 |
| SHA512 | 93b64bd8bdfc355e5c824c53d645be1b6dc26be584705b32588492f828d4e66a0791eedf3f8be04047fec04f315e55515929f9646bd1f4408d58e66c7e93ebbf |
memory/1756-123-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/1280-125-0x00000000000F0000-0x00000000000F1000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2022-02-17 00:10
Reported
2022-02-17 00:24
Platform
win10v2004-en-20220113
Max time kernel
161s
Max time network
172s
Command Line
Signatures
NetWire RAT payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Netwire
WarzoneRat, AveMaria
Warzone RAT Payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Blasthost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Blasthost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\Blasthost.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
| Key value queried | \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 1836 set thread context of 3468 | N/A | C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe | C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe |
| PID 2864 set thread context of 696 | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe |
| PID 3652 set thread context of 2504 | N/A | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe | C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe |
autoit_exe
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File opened for modification | C:\Windows\Logs\CBS\CBS.log | C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe | N/A |
| File opened for modification | C:\Windows\WinSxS\pending.xml | C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe | N/A |
| File opened for modification | C:\Windows\WindowsUpdate.log | C:\Windows\system32\svchost.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk | C:\Windows\system32\svchost.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log | C:\Windows\system32\svchost.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\DataStore\DataStore.edb | C:\Windows\system32\svchost.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm | C:\Windows\system32\svchost.exe | N/A |
| File opened for modification | C:\Windows\SoftwareDistribution\ReportingEvents.log | C:\Windows\system32\svchost.exe | N/A |
Enumerates physical storage devices
Creates scheduled task(s)
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe
"C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"
C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"
C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe
"C:\Users\Admin\AppData\Local\Temp\80b036e873f28aa2614ef9919cb77cdba710d6c0190a90490ebf0c876e23e7f9.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
C:\Users\Admin\AppData\Roaming\Blasthost.exe
"C:\Users\Admin\AppData\Roaming\Blasthost.exe"
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"
C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F
Network
| Country | Destination | Domain | Proto |
| US | 52.109.8.20:443 | tcp | |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| NL | 104.110.191.140:80 | tcp | |
| NL | 104.110.191.140:80 | tcp | |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 20.189.173.9:443 | tcp | |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | Wealthy2019.com.strangled.net | udp |
| US | 8.8.8.8:53 | wealth.warzonedns.com | udp |
| US | 8.8.8.8:53 | wealthyme.ddns.net | udp |
Files
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
memory/1836-137-0x0000000004940000-0x0000000004941000-memory.dmp
memory/3468-138-0x0000000000400000-0x000000000041D000-memory.dmp
memory/3468-145-0x0000000000400000-0x000000000041D000-memory.dmp
memory/1588-146-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/3924-147-0x0000020A80770000-0x0000020A80780000-memory.dmp
memory/3924-148-0x0000020A80E20000-0x0000020A80E30000-memory.dmp
memory/3924-149-0x0000020A834F0000-0x0000020A834F4000-memory.dmp
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | c216632cba79a4374f8f063b4afc13fa |
| SHA1 | ebec29ccc8a6e02d74aaba3b545da4d85ae6a414 |
| SHA256 | 96706c2d8465ed0eb59c8e987ba0b09ea7c010d9b4a14833144419bf2cf39ab0 |
| SHA512 | 9ded01a01d80895a07966bbaeac6ca939b98ae551a537d75dff9b45d7e5a187dc401f885918a09aa51ae4135de66b36f1f55263093c7e196e7be042fc47eb2d3 |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | c216632cba79a4374f8f063b4afc13fa |
| SHA1 | ebec29ccc8a6e02d74aaba3b545da4d85ae6a414 |
| SHA256 | 96706c2d8465ed0eb59c8e987ba0b09ea7c010d9b4a14833144419bf2cf39ab0 |
| SHA512 | 9ded01a01d80895a07966bbaeac6ca939b98ae551a537d75dff9b45d7e5a187dc401f885918a09aa51ae4135de66b36f1f55263093c7e196e7be042fc47eb2d3 |
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | c216632cba79a4374f8f063b4afc13fa |
| SHA1 | ebec29ccc8a6e02d74aaba3b545da4d85ae6a414 |
| SHA256 | 96706c2d8465ed0eb59c8e987ba0b09ea7c010d9b4a14833144419bf2cf39ab0 |
| SHA512 | 9ded01a01d80895a07966bbaeac6ca939b98ae551a537d75dff9b45d7e5a187dc401f885918a09aa51ae4135de66b36f1f55263093c7e196e7be042fc47eb2d3 |
memory/2864-162-0x0000000000990000-0x0000000000991000-memory.dmp
memory/640-163-0x0000000000FC0000-0x0000000000FC1000-memory.dmp
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | c216632cba79a4374f8f063b4afc13fa |
| SHA1 | ebec29ccc8a6e02d74aaba3b545da4d85ae6a414 |
| SHA256 | 96706c2d8465ed0eb59c8e987ba0b09ea7c010d9b4a14833144419bf2cf39ab0 |
| SHA512 | 9ded01a01d80895a07966bbaeac6ca939b98ae551a537d75dff9b45d7e5a187dc401f885918a09aa51ae4135de66b36f1f55263093c7e196e7be042fc47eb2d3 |
C:\Users\Admin\AppData\Roaming\Blasthost.exe
| MD5 | 6087bf6af59b9c531f2c9bb421d5e902 |
| SHA1 | 8bc0f1596c986179b82585c703bacae6d2a00316 |
| SHA256 | 3a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c |
| SHA512 | c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292 |
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe
| MD5 | c216632cba79a4374f8f063b4afc13fa |
| SHA1 | ebec29ccc8a6e02d74aaba3b545da4d85ae6a414 |
| SHA256 | 96706c2d8465ed0eb59c8e987ba0b09ea7c010d9b4a14833144419bf2cf39ab0 |
| SHA512 | 9ded01a01d80895a07966bbaeac6ca939b98ae551a537d75dff9b45d7e5a187dc401f885918a09aa51ae4135de66b36f1f55263093c7e196e7be042fc47eb2d3 |
memory/1820-176-0x00000000007F0000-0x00000000007F1000-memory.dmp