Analysis
-
max time kernel
166s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
17/02/2022, 00:15
Behavioral task
behavioral1
Sample
7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe
Resource
win10v2004-en-20220113
General
-
Target
7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe
-
Size
1.3MB
-
MD5
fc73ae5a62f88d3f07bd0c92a4a09802
-
SHA1
1f1a1f5dcd3c57d0e9ff9ed2f1b394afcb4eb888
-
SHA256
7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd
-
SHA512
6fb637b13b0bd8254b835a2193d6ef391ca99bf79bd7d9e50467262b1575d560eb2ddb811150aab3fcde50b823e52176738c8e4cd3f8becc9b20af555318b1c4
Malware Config
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 12 IoCs
resource yara_rule behavioral2/files/0x000500000001e7d1-131.dat netwire behavioral2/files/0x000500000001e7d1-130.dat netwire behavioral2/files/0x000300000001e7e8-137.dat netwire behavioral2/files/0x000300000001e7e8-136.dat netwire behavioral2/files/0x000300000001e7ee-147.dat netwire behavioral2/files/0x000300000001e7ee-148.dat netwire behavioral2/files/0x000500000001e7d1-149.dat netwire behavioral2/files/0x000300000001e7ee-157.dat netwire behavioral2/files/0x000500000001e7d1-160.dat netwire behavioral2/files/0x000300000001e7ee-161.dat netwire behavioral2/files/0x000500000001e7d1-162.dat netwire behavioral2/files/0x000300000001e7ee-170.dat netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 6 IoCs
resource yara_rule behavioral2/memory/756-133-0x0000000000E00000-0x0000000000E1D000-memory.dmp warzonerat behavioral2/memory/756-142-0x0000000000E00000-0x0000000000E1D000-memory.dmp warzonerat behavioral2/memory/3640-150-0x00000000014C0000-0x00000000014DD000-memory.dmp warzonerat behavioral2/memory/3640-158-0x00000000014C0000-0x00000000014DD000-memory.dmp warzonerat behavioral2/memory/4608-163-0x0000000001680000-0x000000000169D000-memory.dmp warzonerat behavioral2/memory/4608-171-0x0000000001680000-0x000000000169D000-memory.dmp warzonerat -
Executes dropped EXE 8 IoCs
pid Process 3164 Blasthost.exe 3336 Host.exe 1920 RtDCpl64.exe 4004 Blasthost.exe 3640 RtDCpl64.exe 4544 RtDCpl64.exe 4588 Blasthost.exe 4608 RtDCpl64.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3924 set thread context of 756 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 85 PID 1920 set thread context of 3640 1920 RtDCpl64.exe 106 PID 4544 set thread context of 4608 4544 RtDCpl64.exe 116 -
autoit_exe 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000300000001e7ee-147.dat autoit_exe behavioral2/files/0x000300000001e7ee-148.dat autoit_exe behavioral2/files/0x000300000001e7ee-157.dat autoit_exe behavioral2/files/0x000300000001e7ee-161.dat autoit_exe behavioral2/files/0x000300000001e7ee-170.dat autoit_exe -
Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1324 schtasks.exe 4704 schtasks.exe 952 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3448 svchost.exe Token: SeCreatePagefilePrivilege 3448 svchost.exe Token: SeShutdownPrivilege 3448 svchost.exe Token: SeCreatePagefilePrivilege 3448 svchost.exe Token: SeShutdownPrivilege 3448 svchost.exe Token: SeCreatePagefilePrivilege 3448 svchost.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe Token: SeRestorePrivilege 2704 TiWorker.exe Token: SeSecurityPrivilege 2704 TiWorker.exe Token: SeBackupPrivilege 2704 TiWorker.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 3924 wrote to memory of 3164 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 82 PID 3924 wrote to memory of 3164 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 82 PID 3924 wrote to memory of 3164 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 82 PID 3924 wrote to memory of 756 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 85 PID 3924 wrote to memory of 756 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 85 PID 3924 wrote to memory of 756 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 85 PID 3924 wrote to memory of 756 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 85 PID 3164 wrote to memory of 3336 3164 Blasthost.exe 86 PID 3164 wrote to memory of 3336 3164 Blasthost.exe 86 PID 3164 wrote to memory of 3336 3164 Blasthost.exe 86 PID 3924 wrote to memory of 756 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 85 PID 3924 wrote to memory of 952 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 87 PID 3924 wrote to memory of 952 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 87 PID 3924 wrote to memory of 952 3924 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 87 PID 756 wrote to memory of 4016 756 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 88 PID 756 wrote to memory of 4016 756 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 88 PID 756 wrote to memory of 4016 756 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 88 PID 756 wrote to memory of 4016 756 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 88 PID 756 wrote to memory of 4016 756 7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe 88 PID 1920 wrote to memory of 4004 1920 RtDCpl64.exe 105 PID 1920 wrote to memory of 4004 1920 RtDCpl64.exe 105 PID 1920 wrote to memory of 4004 1920 RtDCpl64.exe 105 PID 1920 wrote to memory of 3640 1920 RtDCpl64.exe 106 PID 1920 wrote to memory of 3640 1920 RtDCpl64.exe 106 PID 1920 wrote to memory of 3640 1920 RtDCpl64.exe 106 PID 1920 wrote to memory of 3640 1920 RtDCpl64.exe 106 PID 1920 wrote to memory of 3640 1920 RtDCpl64.exe 106 PID 3640 wrote to memory of 2108 3640 RtDCpl64.exe 107 PID 3640 wrote to memory of 2108 3640 RtDCpl64.exe 107 PID 3640 wrote to memory of 2108 3640 RtDCpl64.exe 107 PID 1920 wrote to memory of 1324 1920 RtDCpl64.exe 109 PID 1920 wrote to memory of 1324 1920 RtDCpl64.exe 109 PID 1920 wrote to memory of 1324 1920 RtDCpl64.exe 109 PID 3640 wrote to memory of 2108 3640 RtDCpl64.exe 107 PID 3640 wrote to memory of 2108 3640 RtDCpl64.exe 107 PID 4544 wrote to memory of 4588 4544 RtDCpl64.exe 115 PID 4544 wrote to memory of 4588 4544 RtDCpl64.exe 115 PID 4544 wrote to memory of 4588 4544 RtDCpl64.exe 115 PID 4544 wrote to memory of 4608 4544 RtDCpl64.exe 116 PID 4544 wrote to memory of 4608 4544 RtDCpl64.exe 116 PID 4544 wrote to memory of 4608 4544 RtDCpl64.exe 116 PID 4544 wrote to memory of 4608 4544 RtDCpl64.exe 116 PID 4544 wrote to memory of 4608 4544 RtDCpl64.exe 116 PID 4608 wrote to memory of 4660 4608 RtDCpl64.exe 117 PID 4608 wrote to memory of 4660 4608 RtDCpl64.exe 117 PID 4608 wrote to memory of 4660 4608 RtDCpl64.exe 117 PID 4544 wrote to memory of 4704 4544 RtDCpl64.exe 119 PID 4544 wrote to memory of 4704 4544 RtDCpl64.exe 119 PID 4544 wrote to memory of 4704 4544 RtDCpl64.exe 119 PID 4608 wrote to memory of 4660 4608 RtDCpl64.exe 117 PID 4608 wrote to memory of 4660 4608 RtDCpl64.exe 117
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe"C:\Users\Admin\AppData\Local\Temp\7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3164 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:3336
-
-
-
C:\Users\Admin\AppData\Local\Temp\7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe"C:\Users\Admin\AppData\Local\Temp\7dfc40d6059ba8ec2d090f10873f8d1490ae39dbe882b4a6d5930550aa95b1bd.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:4016
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:952
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:4004
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:2108
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1324
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:4588
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:4660
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4704
-