Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 05:57

General

  • Target

    jfilyg7.exe

  • Size

    383KB

  • MD5

    96b5dcad2ade88e0c99e84b4869224e7

  • SHA1

    f23d4988ca9ef6fcf9e219dd249eff9988d5f7c5

  • SHA256

    722c36abd195cce70ee25b48d6e64873262e046eae7433976120a1496f01487d

  • SHA512

    8ed9e7fa921b1c75ac6aec5016c138f213b0ff6341d263783d716db530da076794336bc02d6c9b141850d0250bf11b60d0ac401425dbfd13d8904a359284fb85

  • SSDEEP

    6144:9NYLVv8Annhw3I54dDhfZfx6k/ZuCsmK4XShgtf:tIidDBZflr

Malware Config

Extracted

Family

colibri

Version

1.2.0

Botnet

Build1

C2

http://zpltcmgodhvvedxtfcygvbgjkvgvcguygytfigj.cc/gate.php

http://yugyuvyugguitgyuigtfyutdtoghghbbgyv.cx/gate.php

Extracted

Family

warzonerat

C2

darkfox.ddns.net:443

Signatures

  • Colibri Loader

    A loader sold as MaaS first seen in August 2021.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 7 IoCs
  • Executes dropped EXE 4 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jfilyg7.exe
    "C:\Users\Admin\AppData\Local\Temp\jfilyg7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4532
    • C:\ProgramData\conhost.exe
      "C:\ProgramData\conhost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1096
      • C:\ProgramData\conhost.exe
        "C:\ProgramData\conhost.exe"
        3⤵
        • Executes dropped EXE
        PID:1732
    • C:\Users\Admin\AppData\Local\Temp\jfilyg7.exe
      "C:\Users\Admin\AppData\Local\Temp\jfilyg7.exe"
      2⤵
      • Drops startup file
      • Adds Run key to start application
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:1036
      • C:\Users\Admin\Documents\MSCommonDriver.exe
        "C:\Users\Admin\Documents\MSCommonDriver.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3604
        • C:\Users\Admin\Documents\MSCommonDriver.exe
          "C:\Users\Admin\Documents\MSCommonDriver.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:4560
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe"
            5⤵
              PID:5088

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Defense Evasion

    Modify Registry

    1
    T1112

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\conhost.exe
      Filesize

      52KB

      MD5

      d8e1495b46cded57eb1423b8bb789834

      SHA1

      db64bc20550e51c602dbb92d07c8f02842efebcc

      SHA256

      aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

      SHA512

      8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

    • C:\ProgramData\conhost.exe
      Filesize

      52KB

      MD5

      d8e1495b46cded57eb1423b8bb789834

      SHA1

      db64bc20550e51c602dbb92d07c8f02842efebcc

      SHA256

      aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

      SHA512

      8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

    • C:\ProgramData\conhost.exe
      Filesize

      52KB

      MD5

      d8e1495b46cded57eb1423b8bb789834

      SHA1

      db64bc20550e51c602dbb92d07c8f02842efebcc

      SHA256

      aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8

      SHA512

      8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb

    • C:\Users\Admin\Documents\MSCommonDriver.exe
      Filesize

      383KB

      MD5

      96b5dcad2ade88e0c99e84b4869224e7

      SHA1

      f23d4988ca9ef6fcf9e219dd249eff9988d5f7c5

      SHA256

      722c36abd195cce70ee25b48d6e64873262e046eae7433976120a1496f01487d

      SHA512

      8ed9e7fa921b1c75ac6aec5016c138f213b0ff6341d263783d716db530da076794336bc02d6c9b141850d0250bf11b60d0ac401425dbfd13d8904a359284fb85

    • C:\Users\Admin\Documents\MSCommonDriver.exe
      Filesize

      383KB

      MD5

      96b5dcad2ade88e0c99e84b4869224e7

      SHA1

      f23d4988ca9ef6fcf9e219dd249eff9988d5f7c5

      SHA256

      722c36abd195cce70ee25b48d6e64873262e046eae7433976120a1496f01487d

      SHA512

      8ed9e7fa921b1c75ac6aec5016c138f213b0ff6341d263783d716db530da076794336bc02d6c9b141850d0250bf11b60d0ac401425dbfd13d8904a359284fb85

    • C:\Users\Admin\Documents\MSCommonDriver.exe
      Filesize

      383KB

      MD5

      96b5dcad2ade88e0c99e84b4869224e7

      SHA1

      f23d4988ca9ef6fcf9e219dd249eff9988d5f7c5

      SHA256

      722c36abd195cce70ee25b48d6e64873262e046eae7433976120a1496f01487d

      SHA512

      8ed9e7fa921b1c75ac6aec5016c138f213b0ff6341d263783d716db530da076794336bc02d6c9b141850d0250bf11b60d0ac401425dbfd13d8904a359284fb85

    • memory/1036-149-0x0000000000400000-0x000000000055A000-memory.dmp
      Filesize

      1MB

    • memory/1036-140-0x0000000000400000-0x000000000055A000-memory.dmp
      Filesize

      1MB

    • memory/1036-142-0x0000000000400000-0x000000000055A000-memory.dmp
      Filesize

      1MB

    • memory/1036-137-0x0000000000000000-mapping.dmp
    • memory/1036-144-0x0000000000400000-0x000000000055A000-memory.dmp
      Filesize

      1MB

    • memory/1096-132-0x0000000000000000-mapping.dmp
    • memory/1732-143-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/1732-136-0x0000000000000000-mapping.dmp
    • memory/1732-138-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

    • memory/3604-145-0x0000000000000000-mapping.dmp
    • memory/3604-148-0x0000000000DD6000-0x0000000000DE4000-memory.dmp
      Filesize

      56KB

    • memory/4532-133-0x0000000000F86000-0x0000000000F94000-memory.dmp
      Filesize

      56KB

    • memory/4560-150-0x0000000000000000-mapping.dmp
    • memory/4560-154-0x0000000000400000-0x000000000055A000-memory.dmp
      Filesize

      1MB

    • memory/4560-155-0x0000000000400000-0x000000000055A000-memory.dmp
      Filesize

      1MB

    • memory/4560-158-0x0000000000400000-0x000000000055A000-memory.dmp
      Filesize

      1MB

    • memory/5088-156-0x0000000000000000-mapping.dmp
    • memory/5088-157-0x0000000001020000-0x0000000001021000-memory.dmp
      Filesize

      4KB