Analysis
- max time kernel
156s - max time network
165s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 03:21
Static task
static1
Behavioral task
behavioral1
Sample
5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe
- Size 1.3MB
- Sample220217-dwhekahfdj
- SHA256 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb
- MD5 c41146af810620f808dfc9e6b7bf71e7
- SHA1 0449806d7ce6c84f154e52413b50751e8942f52d
- SHA512 f57bbe3959c2cc2e9888e6bf6022aef0cb76b974da8a12021df56505b3755c984c710957c757df749068d8eb9e6ebeda572813428a7bb3c63e9a6fcfe167b6fa
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
wealth.warzonedns.com:5202
Signatures
- NetWire RAT payload 12 IoCs
resource yara_rule behavioral2/files/0x000400000001e8b7-131.dat netwire behavioral2/files/0x000400000001e8b7-130.dat netwire behavioral2/files/0x000500000001e8c8-134.dat netwire behavioral2/files/0x000500000001e8c8-135.dat netwire behavioral2/files/0x000500000001e8ca-144.dat netwire behavioral2/files/0x000500000001e8ca-145.dat netwire behavioral2/files/0x000400000001e8b7-146.dat netwire behavioral2/files/0x000500000001e8ca-154.dat netwire behavioral2/files/0x000400000001e8b7-177.dat netwire behavioral2/files/0x000500000001e8ca-178.dat netwire behavioral2/files/0x000400000001e8b7-179.dat netwire behavioral2/files/0x000500000001e8ca-187.dat netwire - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 2 IoCs
resource yara_rule behavioral2/memory/3344-133-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/3344-142-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat - Executes dropped EXE 8 IoCs
pid Process 1520 Blasthost.exe 4384 Host.exe 3604 RtDCpl64.exe 1672 Blasthost.exe 1864 RtDCpl64.exe 2300 RtDCpl64.exe 1492 Blasthost.exe 1580 RtDCpl64.exe - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RtDCpl64.exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 5064 set thread context of 3344 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 84 PID 3604 set thread context of 1864 3604 RtDCpl64.exe 103 PID 2300 set thread context of 1580 2300 RtDCpl64.exe 115 - autoit_exe 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x000500000001e8ca-144.dat autoit_exe behavioral2/files/0x000500000001e8ca-145.dat autoit_exe behavioral2/files/0x000500000001e8ca-154.dat autoit_exe behavioral2/files/0x000500000001e8ca-178.dat autoit_exe behavioral2/files/0x000500000001e8ca-187.dat autoit_exe - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3476 schtasks.exe 2232 schtasks.exe 2180 schtasks.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1192 svchost.exe Token: SeCreatePagefilePrivilege 1192 svchost.exe Token: SeShutdownPrivilege 1192 svchost.exe Token: SeCreatePagefilePrivilege 1192 svchost.exe Token: SeShutdownPrivilege 1192 svchost.exe Token: SeCreatePagefilePrivilege 1192 svchost.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe Token: SeRestorePrivilege 2968 TiWorker.exe Token: SeSecurityPrivilege 2968 TiWorker.exe Token: SeBackupPrivilege 2968 TiWorker.exe - Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 5064 wrote to memory of 1520 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 82 PID 5064 wrote to memory of 1520 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 82 PID 5064 wrote to memory of 1520 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 82 PID 5064 wrote to memory of 3344 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 84 PID 5064 wrote to memory of 3344 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 84 PID 5064 wrote to memory of 3344 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 84 PID 1520 wrote to memory of 4384 1520 Blasthost.exe 85 PID 1520 wrote to memory of 4384 1520 Blasthost.exe 85 PID 1520 wrote to memory of 4384 1520 Blasthost.exe 85 PID 5064 wrote to memory of 3344 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 84 PID 5064 wrote to memory of 3344 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 84 PID 5064 wrote to memory of 3476 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 86 PID 5064 wrote to memory of 3476 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 86 PID 5064 wrote to memory of 3476 5064 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 86 PID 3344 wrote to memory of 3328 3344 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 87 PID 3344 wrote to memory of 3328 3344 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 87 PID 3344 wrote to memory of 3328 3344 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 87 PID 3344 wrote to memory of 3328 3344 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 87 PID 3344 wrote to memory of 3328 3344 5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe 87 PID 3604 wrote to memory of 1672 3604 RtDCpl64.exe 102 PID 3604 wrote to memory of 1672 3604 RtDCpl64.exe 102 PID 3604 wrote to memory of 1672 3604 RtDCpl64.exe 102 PID 3604 wrote to memory of 1864 3604 RtDCpl64.exe 103 PID 3604 wrote to memory of 1864 3604 RtDCpl64.exe 103 PID 3604 wrote to memory of 1864 3604 RtDCpl64.exe 103 PID 3604 wrote to memory of 1864 3604 RtDCpl64.exe 103 PID 3604 wrote to memory of 1864 3604 RtDCpl64.exe 103 PID 1864 wrote to memory of 700 1864 RtDCpl64.exe 104 PID 1864 wrote to memory of 700 1864 RtDCpl64.exe 104 PID 1864 wrote to memory of 700 1864 RtDCpl64.exe 104 PID 1864 wrote to memory of 700 1864 RtDCpl64.exe 104 PID 1864 wrote to memory of 700 1864 RtDCpl64.exe 104 PID 3604 wrote to memory of 2232 3604 RtDCpl64.exe 106 PID 3604 wrote to memory of 2232 3604 RtDCpl64.exe 106 PID 3604 wrote to memory of 2232 3604 RtDCpl64.exe 106 PID 2300 wrote to memory of 1492 2300 RtDCpl64.exe 114 PID 2300 wrote to memory of 1492 2300 RtDCpl64.exe 114 PID 2300 wrote to memory of 1492 2300 RtDCpl64.exe 114 PID 2300 wrote to memory of 1580 2300 RtDCpl64.exe 115 PID 2300 wrote to memory of 1580 2300 RtDCpl64.exe 115 PID 2300 wrote to memory of 1580 2300 RtDCpl64.exe 115 PID 2300 wrote to memory of 1580 2300 RtDCpl64.exe 115 PID 2300 wrote to memory of 1580 2300 RtDCpl64.exe 115 PID 2300 wrote to memory of 2180 2300 RtDCpl64.exe 116 PID 2300 wrote to memory of 2180 2300 RtDCpl64.exe 116 PID 2300 wrote to memory of 2180 2300 RtDCpl64.exe 116 PID 1580 wrote to memory of 3808 1580 RtDCpl64.exe 118 PID 1580 wrote to memory of 3808 1580 RtDCpl64.exe 118 PID 1580 wrote to memory of 3808 1580 RtDCpl64.exe 118 PID 1580 wrote to memory of 3808 1580 RtDCpl64.exe 118 PID 1580 wrote to memory of 3808 1580 RtDCpl64.exe 118
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe"C:\Users\Admin\AppData\Local\Temp\5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1520 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:4384
-
-
-
C:\Users\Admin\AppData\Local\Temp\5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe"C:\Users\Admin\AppData\Local\Temp\5a63f5e441a907840a3ca0e595072a3355c1460d4c38753f9e488e469336e5fb.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:3328
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:3476
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3604 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:1672
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:700
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2232
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1192
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2300 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:1492
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:3808
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2180
-