Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
22-09-2022 15:07
Static task
static1
Behavioral task
behavioral1
Sample
1936208b2a0d3667bc8eb7df9a86a4aa.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1936208b2a0d3667bc8eb7df9a86a4aa.exe
Resource
win10v2004-20220812-en
General
-
Target
1936208b2a0d3667bc8eb7df9a86a4aa.exe
-
Size
3.9MB
-
MD5
1936208b2a0d3667bc8eb7df9a86a4aa
-
SHA1
45a941e8124435df1b0db1488e6a400f436004c7
-
SHA256
3bcfe5eeac91dfdb5e391f8f1f7163a731a101978d4f906e6d759f74ed92297c
-
SHA512
7cc7bec4674768efc26deeb944523bce4d4c0db8613d124a7a19e8565b90ea49e8888a6605ee6b35523ac1a3379d9733cca1b888f31e03b1b9c75d2e068b004b
-
SSDEEP
98304:/+7NALEU32eBhBsUsX7q6NKOuMZBBElHlmFsDyFyypr++W:/4NA52UaU0rJ72lysCDr+H
Malware Config
Extracted
warzonerat
sheet.duckdns.org:4110
Extracted
bitrat
1.38
sheet.duckdns.org:8471
-
communication_password
81dc9bdb52d04dc20036dbd8313ed055
-
install_dir
Install path
-
install_file
Install name
-
tor_process
tor
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\explorer.exe warzonerat C:\Users\Admin\AppData\Local\Temp\explorer.exe warzonerat C:\Users\Admin\Documents\explorer.exe warzonerat C:\Users\Admin\Documents\explorer.exe warzonerat -
Executes dropped EXE 3 IoCs
Processes:
explorer.exeupdater.exeexplorer.exepid process 1880 explorer.exe 4372 updater.exe 2236 explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
1936208b2a0d3667bc8eb7df9a86a4aa.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation 1936208b2a0d3667bc8eb7df9a86a4aa.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
updater.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install name" updater.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Install name = "C:\\Users\\Admin\\AppData\\Local\\Install path\\Install nameȀ" updater.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
Processes:
updater.exepid process 4372 updater.exe 4372 updater.exe 4372 updater.exe 4372 updater.exe 4372 updater.exe 4372 updater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE -
Modifies registry class 1 IoCs
Processes:
1936208b2a0d3667bc8eb7df9a86a4aa.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings 1936208b2a0d3667bc8eb7df9a86a4aa.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2344 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepowershell.exepid process 1116 powershell.exe 1116 powershell.exe 956 powershell.exe 956 powershell.exe 1008 powershell.exe 1008 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exeupdater.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1116 powershell.exe Token: SeShutdownPrivilege 4372 updater.exe Token: SeDebugPrivilege 956 powershell.exe Token: SeDebugPrivilege 1008 powershell.exe -
Suspicious use of SetWindowsHookEx 14 IoCs
Processes:
EXCEL.EXEupdater.exepid process 2344 EXCEL.EXE 4372 updater.exe 4372 updater.exe 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE 2344 EXCEL.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
1936208b2a0d3667bc8eb7df9a86a4aa.exeexplorer.exeexplorer.exedescription pid process target process PID 2412 wrote to memory of 1116 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe powershell.exe PID 2412 wrote to memory of 1116 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe powershell.exe PID 2412 wrote to memory of 1116 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe powershell.exe PID 2412 wrote to memory of 1880 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe explorer.exe PID 2412 wrote to memory of 1880 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe explorer.exe PID 2412 wrote to memory of 1880 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe explorer.exe PID 2412 wrote to memory of 4372 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe updater.exe PID 2412 wrote to memory of 4372 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe updater.exe PID 2412 wrote to memory of 4372 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe updater.exe PID 2412 wrote to memory of 2344 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe EXCEL.EXE PID 2412 wrote to memory of 2344 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe EXCEL.EXE PID 2412 wrote to memory of 2344 2412 1936208b2a0d3667bc8eb7df9a86a4aa.exe EXCEL.EXE PID 1880 wrote to memory of 956 1880 explorer.exe powershell.exe PID 1880 wrote to memory of 956 1880 explorer.exe powershell.exe PID 1880 wrote to memory of 956 1880 explorer.exe powershell.exe PID 1880 wrote to memory of 2236 1880 explorer.exe explorer.exe PID 1880 wrote to memory of 2236 1880 explorer.exe explorer.exe PID 1880 wrote to memory of 2236 1880 explorer.exe explorer.exe PID 2236 wrote to memory of 1008 2236 explorer.exe powershell.exe PID 2236 wrote to memory of 1008 2236 explorer.exe powershell.exe PID 2236 wrote to memory of 1008 2236 explorer.exe powershell.exe PID 2236 wrote to memory of 1936 2236 explorer.exe cmd.exe PID 2236 wrote to memory of 1936 2236 explorer.exe cmd.exe PID 2236 wrote to memory of 1936 2236 explorer.exe cmd.exe PID 2236 wrote to memory of 1936 2236 explorer.exe cmd.exe PID 2236 wrote to memory of 1936 2236 explorer.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1936208b2a0d3667bc8eb7df9a86a4aa.exe"C:\Users\Admin\AppData\Local\Temp\1936208b2a0d3667bc8eb7df9a86a4aa.exe"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGcAcQBoACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAHUAZwBhACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAGYAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAHcAYwBzACMAPgA="2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\explorer.exe"C:\Users\Admin\AppData\Local\Temp\explorer.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Documents\explorer.exe"C:\Users\Admin\Documents\explorer.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Users\Admin\AppData\Local\Temp\updater.exe"C:\Users\Admin\AppData\Local\Temp\updater.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\budget.xlsx"2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD589288888aa6f148fdf1f4d5a4042ab28
SHA15732078a64533af55f987296b744a13fb66bf7e8
SHA2561eaebeeec4a2e24c450a097e0f427c492a85b4313262acf5cbdf828681c45d58
SHA512c96ce7e26c753a4f39a7ce6bf4168e2d38ba1aa958eebbad39ed0994b44546eea45f6d93c4c74d13a6ceb14909679a2a31cdede0a0296c1bcfc2f08aab0d1d3a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD589288888aa6f148fdf1f4d5a4042ab28
SHA15732078a64533af55f987296b744a13fb66bf7e8
SHA2561eaebeeec4a2e24c450a097e0f427c492a85b4313262acf5cbdf828681c45d58
SHA512c96ce7e26c753a4f39a7ce6bf4168e2d38ba1aa958eebbad39ed0994b44546eea45f6d93c4c74d13a6ceb14909679a2a31cdede0a0296c1bcfc2f08aab0d1d3a
-
C:\Users\Admin\AppData\Local\Temp\budget.xlsxFilesize
20KB
MD5f73ebdb3d2562351e70c5476172ff4c4
SHA149bf5e4428855a9b9f311e7127fd4ce0d5f89eb3
SHA2564454f6250448bb08bbde2c54ac7308323bd60814461009cedba512781bc4d226
SHA5123b3223841b40aa623edd68aed7e572c9703f55a10731f9077435e262813db3de2947880632f60f590d02a8f7248df30b93a8d1f9fef89b125031749c8c5ef5db
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\AppData\Local\Temp\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\AppData\Local\Temp\updater.exeFilesize
3.8MB
MD54ab049723f3f39517e74252409d34cc3
SHA17115fdc392fb8972c368f13c394f045ff76355fc
SHA2569a5c441ddb5578d4f3d2f0c574c6b2311793b0f6fdb25ca437390a9d3aeaf49c
SHA5127281cc6cd16f2f0174af814ba8e38f7f7fffe1503ddcc42954111371b16e61157c66667b6511a107adc853b25383978f1d531a05d2075e05deee28428e20386f
-
C:\Users\Admin\AppData\Local\Temp\updater.exeFilesize
3.8MB
MD54ab049723f3f39517e74252409d34cc3
SHA17115fdc392fb8972c368f13c394f045ff76355fc
SHA2569a5c441ddb5578d4f3d2f0c574c6b2311793b0f6fdb25ca437390a9d3aeaf49c
SHA5127281cc6cd16f2f0174af814ba8e38f7f7fffe1503ddcc42954111371b16e61157c66667b6511a107adc853b25383978f1d531a05d2075e05deee28428e20386f
-
C:\Users\Admin\Documents\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
C:\Users\Admin\Documents\explorer.exeFilesize
132KB
MD56323c6a420ae7a3b7ace4a0a7bca4edd
SHA177b91d13642dfe93784470893111742c123c2244
SHA2562fb55700d343afcad180486bedddb4ce8a632d11cbbde696d8db7a165543ae90
SHA512bba9ad737f58366d4d34493652bdc247e5afc3884259bdf2035576ded750e3663bd946b7b0996a5e91015465ada8f162e65b2fcaaab963767395b1fbe447675c
-
memory/956-154-0x0000000000000000-mapping.dmp
-
memory/956-164-0x0000000075750000-0x000000007579C000-memory.dmpFilesize
304KB
-
memory/1008-174-0x0000000000000000-mapping.dmp
-
memory/1008-176-0x0000000075750000-0x000000007579C000-memory.dmpFilesize
304KB
-
memory/1116-145-0x0000000005530000-0x0000000005596000-memory.dmpFilesize
408KB
-
memory/1116-142-0x0000000004D20000-0x0000000005348000-memory.dmpFilesize
6.2MB
-
memory/1116-140-0x00000000025F0000-0x0000000002626000-memory.dmpFilesize
216KB
-
memory/1116-143-0x0000000004CC0000-0x0000000004CE2000-memory.dmpFilesize
136KB
-
memory/1116-144-0x00000000054C0000-0x0000000005526000-memory.dmpFilesize
408KB
-
memory/1116-151-0x0000000005B60000-0x0000000005B7E000-memory.dmpFilesize
120KB
-
memory/1116-167-0x0000000007100000-0x0000000007108000-memory.dmpFilesize
32KB
-
memory/1116-166-0x00000000071B0000-0x00000000071CA000-memory.dmpFilesize
104KB
-
memory/1116-165-0x00000000070C0000-0x00000000070CE000-memory.dmpFilesize
56KB
-
memory/1116-132-0x0000000000000000-mapping.dmp
-
memory/1116-163-0x0000000007110000-0x00000000071A6000-memory.dmpFilesize
600KB
-
memory/1116-157-0x0000000006130000-0x0000000006162000-memory.dmpFilesize
200KB
-
memory/1116-158-0x0000000075750000-0x000000007579C000-memory.dmpFilesize
304KB
-
memory/1116-159-0x0000000006110000-0x000000000612E000-memory.dmpFilesize
120KB
-
memory/1116-160-0x00000000074C0000-0x0000000007B3A000-memory.dmpFilesize
6.5MB
-
memory/1116-161-0x0000000006E80000-0x0000000006E9A000-memory.dmpFilesize
104KB
-
memory/1116-162-0x0000000006EF0000-0x0000000006EFA000-memory.dmpFilesize
40KB
-
memory/1880-133-0x0000000000000000-mapping.dmp
-
memory/1936-178-0x0000000000ED0000-0x0000000000ED1000-memory.dmpFilesize
4KB
-
memory/1936-177-0x0000000000000000-mapping.dmp
-
memory/2236-169-0x0000000000000000-mapping.dmp
-
memory/2344-183-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-150-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-152-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmpFilesize
64KB
-
memory/2344-149-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-147-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-141-0x0000000000000000-mapping.dmp
-
memory/2344-148-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-185-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-184-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-146-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/2344-153-0x00007FF80F3E0000-0x00007FF80F3F0000-memory.dmpFilesize
64KB
-
memory/2344-186-0x00007FF811CF0000-0x00007FF811D00000-memory.dmpFilesize
64KB
-
memory/4372-156-0x0000000073960000-0x0000000073999000-memory.dmpFilesize
228KB
-
memory/4372-180-0x00000000756D0000-0x0000000075709000-memory.dmpFilesize
228KB
-
memory/4372-181-0x0000000073960000-0x0000000073999000-memory.dmpFilesize
228KB
-
memory/4372-179-0x0000000075870000-0x00000000758A9000-memory.dmpFilesize
228KB
-
memory/4372-136-0x0000000000000000-mapping.dmp
-
memory/4372-139-0x0000000000400000-0x00000000007CE000-memory.dmpFilesize
3.8MB
-
memory/4372-155-0x00000000756D0000-0x0000000075709000-memory.dmpFilesize
228KB