Analysis
- max time kernel
152s - max time network
128s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
10/03/2022, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
paneldecontrol.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
paneldecontrol.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target paneldecontrol.exe
- Size 1.3MB
- Sample220310-e12jnsghaj
- SHA256 d2df9078d5a72c5212ef2423afc8a6b04f50ab4f4c79f63f270c2d8249ebd3d9
- MD5 a8956431106c4e1d5585d8049303dd07
- SHA1 597820936213ac60146291fa24c90e4f2539693a
- SHA512 52351beaf54b01d0941c82435add74eaa355ec716462a30bfc3d4bae45df6b7d7b9c9cd0a281c50f3ce72fc248bc52acc82a82b6dfc63f95611bd553cd14f2ea
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
wealth.warzonedns.com:5202
Signatures
- NetWire RAT payload 25 IoCs
resource yara_rule behavioral1/files/0x000700000001326b-56.dat netwire behavioral1/files/0x000700000001326b-57.dat netwire behavioral1/files/0x000700000001326b-59.dat netwire behavioral1/files/0x000700000001326b-58.dat netwire behavioral1/files/0x000700000001326b-60.dat netwire behavioral1/files/0x000700000001326b-74.dat netwire behavioral1/files/0x00060000000134d9-78.dat netwire behavioral1/files/0x00060000000134d9-77.dat netwire behavioral1/files/0x00060000000134d9-76.dat netwire behavioral1/files/0x00070000000132df-85.dat netwire behavioral1/files/0x00070000000132df-86.dat netwire behavioral1/files/0x000700000001326b-88.dat netwire behavioral1/files/0x000700000001326b-89.dat netwire behavioral1/files/0x000700000001326b-90.dat netwire behavioral1/files/0x000700000001326b-91.dat netwire behavioral1/files/0x000700000001326b-92.dat netwire behavioral1/files/0x00060000000134d9-94.dat netwire behavioral1/files/0x00070000000132df-105.dat netwire behavioral1/files/0x000700000001326b-114.dat netwire behavioral1/files/0x00070000000132df-115.dat netwire behavioral1/files/0x000700000001326b-117.dat netwire behavioral1/files/0x000700000001326b-118.dat netwire behavioral1/files/0x000700000001326b-119.dat netwire behavioral1/files/0x000700000001326b-120.dat netwire behavioral1/files/0x00070000000132df-132.dat netwire - WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 5 IoCs
resource yara_rule behavioral1/memory/1480-63-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/1480-73-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/1612-97-0x00000000000C0000-0x00000000000DD000-memory.dmp warzonerat behavioral1/memory/1612-107-0x00000000000C0000-0x00000000000DD000-memory.dmp warzonerat behavioral1/memory/2044-108-0x00000000006E0000-0x000000000070C000-memory.dmp warzonerat - Executes dropped EXE 8 IoCs
pid Process 1064 Blasthost.exe 1080 Host.exe 2044 RtDCpl64.exe 1788 Blasthost.exe 1612 RtDCpl64.exe 1104 RtDCpl64.exe 848 Blasthost.exe 824 RtDCpl64.exe - Loads dropped DLL 13 IoCs
pid Process 1272 paneldecontrol.exe 1272 paneldecontrol.exe 1272 paneldecontrol.exe 1272 paneldecontrol.exe 1064 Blasthost.exe 1064 Blasthost.exe 2044 RtDCpl64.exe 2044 RtDCpl64.exe 2044 RtDCpl64.exe 2044 RtDCpl64.exe 1104 RtDCpl64.exe 1104 RtDCpl64.exe 1104 RtDCpl64.exe - AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00070000000132df-85.dat autoit_exe behavioral1/files/0x00070000000132df-86.dat autoit_exe behavioral1/files/0x00070000000132df-105.dat autoit_exe behavioral1/files/0x00070000000132df-115.dat autoit_exe behavioral1/files/0x00070000000132df-132.dat autoit_exe - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1272 set thread context of 1480 1272 paneldecontrol.exe 28 PID 2044 set thread context of 1612 2044 RtDCpl64.exe 39 PID 1104 set thread context of 824 1104 RtDCpl64.exe 46 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 384 schtasks.exe 1376 schtasks.exe 1604 schtasks.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1272 wrote to memory of 1064 1272 paneldecontrol.exe 27 PID 1272 wrote to memory of 1064 1272 paneldecontrol.exe 27 PID 1272 wrote to memory of 1064 1272 paneldecontrol.exe 27 PID 1272 wrote to memory of 1064 1272 paneldecontrol.exe 27 PID 1272 wrote to memory of 1480 1272 paneldecontrol.exe 28 PID 1272 wrote to memory of 1480 1272 paneldecontrol.exe 28 PID 1272 wrote to memory of 1480 1272 paneldecontrol.exe 28 PID 1272 wrote to memory of 1480 1272 paneldecontrol.exe 28 PID 1272 wrote to memory of 1480 1272 paneldecontrol.exe 28 PID 1272 wrote to memory of 1480 1272 paneldecontrol.exe 28 PID 1064 wrote to memory of 1080 1064 Blasthost.exe 29 PID 1064 wrote to memory of 1080 1064 Blasthost.exe 29 PID 1064 wrote to memory of 1080 1064 Blasthost.exe 29 PID 1064 wrote to memory of 1080 1064 Blasthost.exe 29 PID 1272 wrote to memory of 1376 1272 paneldecontrol.exe 31 PID 1272 wrote to memory of 1376 1272 paneldecontrol.exe 31 PID 1272 wrote to memory of 1376 1272 paneldecontrol.exe 31 PID 1272 wrote to memory of 1376 1272 paneldecontrol.exe 31 PID 1480 wrote to memory of 1944 1480 paneldecontrol.exe 30 PID 1480 wrote to memory of 1944 1480 paneldecontrol.exe 30 PID 1480 wrote to memory of 1944 1480 paneldecontrol.exe 30 PID 1480 wrote to memory of 1944 1480 paneldecontrol.exe 30 PID 1480 wrote to memory of 1944 1480 paneldecontrol.exe 30 PID 1480 wrote to memory of 1944 1480 paneldecontrol.exe 30 PID 1712 wrote to memory of 2044 1712 taskeng.exe 37 PID 1712 wrote to memory of 2044 1712 taskeng.exe 37 PID 1712 wrote to memory of 2044 1712 taskeng.exe 37 PID 1712 wrote to memory of 2044 1712 taskeng.exe 37 PID 2044 wrote to memory of 1788 2044 RtDCpl64.exe 38 PID 2044 wrote to memory of 1788 2044 RtDCpl64.exe 38 PID 2044 wrote to memory of 1788 2044 RtDCpl64.exe 38 PID 2044 wrote to memory of 1788 2044 RtDCpl64.exe 38 PID 2044 wrote to memory of 1612 2044 RtDCpl64.exe 39 PID 2044 wrote to memory of 1612 2044 RtDCpl64.exe 39 PID 2044 wrote to memory of 1612 2044 RtDCpl64.exe 39 PID 2044 wrote to memory of 1612 2044 RtDCpl64.exe 39 PID 2044 wrote to memory of 1612 2044 RtDCpl64.exe 39 PID 2044 wrote to memory of 1612 2044 RtDCpl64.exe 39 PID 2044 wrote to memory of 1604 2044 RtDCpl64.exe 40 PID 2044 wrote to memory of 1604 2044 RtDCpl64.exe 40 PID 2044 wrote to memory of 1604 2044 RtDCpl64.exe 40 PID 2044 wrote to memory of 1604 2044 RtDCpl64.exe 40 PID 1612 wrote to memory of 2036 1612 RtDCpl64.exe 41 PID 1612 wrote to memory of 2036 1612 RtDCpl64.exe 41 PID 1612 wrote to memory of 2036 1612 RtDCpl64.exe 41 PID 1612 wrote to memory of 2036 1612 RtDCpl64.exe 41 PID 1612 wrote to memory of 2036 1612 RtDCpl64.exe 41 PID 1612 wrote to memory of 2036 1612 RtDCpl64.exe 41 PID 1712 wrote to memory of 1104 1712 taskeng.exe 44 PID 1712 wrote to memory of 1104 1712 taskeng.exe 44 PID 1712 wrote to memory of 1104 1712 taskeng.exe 44 PID 1712 wrote to memory of 1104 1712 taskeng.exe 44 PID 1104 wrote to memory of 848 1104 RtDCpl64.exe 45 PID 1104 wrote to memory of 848 1104 RtDCpl64.exe 45 PID 1104 wrote to memory of 848 1104 RtDCpl64.exe 45 PID 1104 wrote to memory of 848 1104 RtDCpl64.exe 45 PID 1104 wrote to memory of 824 1104 RtDCpl64.exe 46 PID 1104 wrote to memory of 824 1104 RtDCpl64.exe 46 PID 1104 wrote to memory of 824 1104 RtDCpl64.exe 46 PID 1104 wrote to memory of 824 1104 RtDCpl64.exe 46 PID 1104 wrote to memory of 824 1104 RtDCpl64.exe 46 PID 1104 wrote to memory of 824 1104 RtDCpl64.exe 46 PID 1104 wrote to memory of 384 1104 RtDCpl64.exe 47 PID 1104 wrote to memory of 384 1104 RtDCpl64.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\paneldecontrol.exe"C:\Users\Admin\AppData\Local\Temp\paneldecontrol.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:1080
-
-
-
C:\Users\Admin\AppData\Local\Temp\paneldecontrol.exe"C:\Users\Admin\AppData\Local\Temp\paneldecontrol.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1944
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1376
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {5F5AF285-1C69-4F40-ACD4-C10D08F98CB6} S-1-5-21-2329389628-4064185017-3901522362-1000:QSKGHMYQ\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2044 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1788
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2036
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1604
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:848
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
PID:824 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:1972
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:384
-
-