Analysis
- max time kernel
164s - max time network
172s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 02:26
Static task
static1
Behavioral task
behavioral1
Sample
62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe
- Size 1.3MB
- Sample220217-cw9clshbdr
- SHA256 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256
- MD5 88b1c2e6f889e742aaa3f03b63e95747
- SHA1 ec4c010ee017f4136500d782f00cd210554434f8
- SHA512 dc95896759ae754e2b46576df2cb8a8b14717ec9cca41fcd2f47aced44385b1da82514a0a103777faadac9a3efbd8a464293e4b5873d0696664eb642a0723480
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
wealth.warzonedns.com:5202
Signatures
- NetWire RAT payload 12 IoCs
resource yara_rule behavioral2/files/0x000500000001e73f-133.dat netwire behavioral2/files/0x000500000001e73f-134.dat netwire behavioral2/files/0x000500000001e783-135.dat netwire behavioral2/files/0x000500000001e783-136.dat netwire behavioral2/files/0x000400000001e788-150.dat netwire behavioral2/files/0x000400000001e788-151.dat netwire behavioral2/files/0x000500000001e73f-152.dat netwire behavioral2/files/0x000400000001e788-160.dat netwire behavioral2/files/0x000500000001e73f-164.dat netwire behavioral2/files/0x000400000001e788-165.dat netwire behavioral2/files/0x000500000001e73f-166.dat netwire behavioral2/files/0x000400000001e788-174.dat netwire - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 4 IoCs
resource yara_rule behavioral2/memory/1364-138-0x0000000000B10000-0x0000000000B2D000-memory.dmp warzonerat behavioral2/memory/1364-145-0x0000000000B10000-0x0000000000B2D000-memory.dmp warzonerat behavioral2/memory/4468-153-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4468-161-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat - Executes dropped EXE 8 IoCs
pid Process 3108 Blasthost.exe 2412 Host.exe 4348 RtDCpl64.exe 4412 Blasthost.exe 4468 RtDCpl64.exe 2320 RtDCpl64.exe 1300 Blasthost.exe 1788 RtDCpl64.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1852 set thread context of 1364 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 85 PID 4348 set thread context of 4468 4348 RtDCpl64.exe 105 PID 2320 set thread context of 1788 2320 RtDCpl64.exe 118 - autoit_exe 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000400000001e788-150.dat autoit_exe behavioral2/files/0x000400000001e788-151.dat autoit_exe behavioral2/files/0x000400000001e788-160.dat autoit_exe behavioral2/files/0x000400000001e788-165.dat autoit_exe behavioral2/files/0x000400000001e788-174.dat autoit_exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4072 schtasks.exe 4572 schtasks.exe 2172 schtasks.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2936 svchost.exe Token: SeCreatePagefilePrivilege 2936 svchost.exe Token: SeShutdownPrivilege 2936 svchost.exe Token: SeCreatePagefilePrivilege 2936 svchost.exe Token: SeShutdownPrivilege 2936 svchost.exe Token: SeCreatePagefilePrivilege 2936 svchost.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe Token: SeRestorePrivilege 4760 TiWorker.exe Token: SeSecurityPrivilege 4760 TiWorker.exe Token: SeBackupPrivilege 4760 TiWorker.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 1852 wrote to memory of 3108 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 82 PID 1852 wrote to memory of 3108 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 82 PID 1852 wrote to memory of 3108 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 82 PID 3108 wrote to memory of 2412 3108 Blasthost.exe 84 PID 3108 wrote to memory of 2412 3108 Blasthost.exe 84 PID 3108 wrote to memory of 2412 3108 Blasthost.exe 84 PID 1852 wrote to memory of 1364 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 85 PID 1852 wrote to memory of 1364 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 85 PID 1852 wrote to memory of 1364 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 85 PID 1852 wrote to memory of 1364 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 85 PID 1852 wrote to memory of 1364 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 85 PID 1852 wrote to memory of 4072 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 86 PID 1852 wrote to memory of 4072 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 86 PID 1852 wrote to memory of 4072 1852 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 86 PID 1364 wrote to memory of 3468 1364 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 87 PID 1364 wrote to memory of 3468 1364 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 87 PID 1364 wrote to memory of 3468 1364 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 87 PID 1364 wrote to memory of 3468 1364 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 87 PID 1364 wrote to memory of 3468 1364 62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe 87 PID 4348 wrote to memory of 4412 4348 RtDCpl64.exe 104 PID 4348 wrote to memory of 4412 4348 RtDCpl64.exe 104 PID 4348 wrote to memory of 4412 4348 RtDCpl64.exe 104 PID 4348 wrote to memory of 4468 4348 RtDCpl64.exe 105 PID 4348 wrote to memory of 4468 4348 RtDCpl64.exe 105 PID 4348 wrote to memory of 4468 4348 RtDCpl64.exe 105 PID 4348 wrote to memory of 4468 4348 RtDCpl64.exe 105 PID 4348 wrote to memory of 4468 4348 RtDCpl64.exe 105 PID 4468 wrote to memory of 4524 4468 RtDCpl64.exe 106 PID 4468 wrote to memory of 4524 4468 RtDCpl64.exe 106 PID 4468 wrote to memory of 4524 4468 RtDCpl64.exe 106 PID 4348 wrote to memory of 4572 4348 RtDCpl64.exe 108 PID 4348 wrote to memory of 4572 4348 RtDCpl64.exe 108 PID 4348 wrote to memory of 4572 4348 RtDCpl64.exe 108 PID 4468 wrote to memory of 4524 4468 RtDCpl64.exe 106 PID 4468 wrote to memory of 4524 4468 RtDCpl64.exe 106 PID 2320 wrote to memory of 1300 2320 RtDCpl64.exe 117 PID 2320 wrote to memory of 1300 2320 RtDCpl64.exe 117 PID 2320 wrote to memory of 1300 2320 RtDCpl64.exe 117 PID 2320 wrote to memory of 1788 2320 RtDCpl64.exe 118 PID 2320 wrote to memory of 1788 2320 RtDCpl64.exe 118 PID 2320 wrote to memory of 1788 2320 RtDCpl64.exe 118 PID 2320 wrote to memory of 1788 2320 RtDCpl64.exe 118 PID 2320 wrote to memory of 1788 2320 RtDCpl64.exe 118 PID 1788 wrote to memory of 1160 1788 RtDCpl64.exe 119 PID 1788 wrote to memory of 1160 1788 RtDCpl64.exe 119 PID 1788 wrote to memory of 1160 1788 RtDCpl64.exe 119 PID 2320 wrote to memory of 2172 2320 RtDCpl64.exe 121 PID 2320 wrote to memory of 2172 2320 RtDCpl64.exe 121 PID 2320 wrote to memory of 2172 2320 RtDCpl64.exe 121 PID 1788 wrote to memory of 1160 1788 RtDCpl64.exe 119 PID 1788 wrote to memory of 1160 1788 RtDCpl64.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe"C:\Users\Admin\AppData\Local\Temp\62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3108 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2412
-
-
-
C:\Users\Admin\AppData\Local\Temp\62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe"C:\Users\Admin\AppData\Local\Temp\62967deea972af7a15c08fb390709ed6f653f0e7759cb40df0cf61dd561ad256.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:3468
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4072
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4348 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:4412
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:4524
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:4572
-
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4760
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:1300
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1160
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2172
-