Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
10-12-2022 09:01
Static task
static1
Behavioral task
behavioral1
Sample
25d10c1c957744485ee6c6f68285e4a1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
25d10c1c957744485ee6c6f68285e4a1.exe
Resource
win10v2004-20220901-en
General
-
Target
25d10c1c957744485ee6c6f68285e4a1.exe
-
Size
800KB
-
MD5
25d10c1c957744485ee6c6f68285e4a1
-
SHA1
49673bbf62d6c73a1358ad2da2b803d6d96249cd
-
SHA256
640cd3c54e536bc56eb35e4ab5a2b965b7d740fc13ac83b0a0d4237512ec56ef
-
SHA512
4e27b9b6fe1c8fc22f284c46abdc88b9464b39d846f4fe0e6b1c813644f99ac41f481991d851b6b64eece690265eaeba0a65f2e5ba64486c31ed5c2d687103ca
-
SSDEEP
12288:qnYVrTlh6Pv6mq0aKxv+yq81CLehz/khAIi3pIOZe:bFP6ZtBO8+VCe
Malware Config
Extracted
warzonerat
dnuocc.com:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 8 IoCs
Processes:
resource yara_rule behavioral1/memory/2028-58-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2028-59-0x0000000000405CE2-mapping.dmp warzonerat behavioral1/memory/2028-62-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2028-63-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2028-69-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/556-71-0x0000000000405CE2-mapping.dmp warzonerat behavioral1/memory/556-75-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/556-76-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
clous.execlous.exepid process 1836 clous.exe 556 clous.exe -
Loads dropped DLL 1 IoCs
Processes:
25d10c1c957744485ee6c6f68285e4a1.exepid process 2028 25d10c1c957744485ee6c6f68285e4a1.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
25d10c1c957744485ee6c6f68285e4a1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\clous = "C:\\ProgramData\\clous.exe" 25d10c1c957744485ee6c6f68285e4a1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
25d10c1c957744485ee6c6f68285e4a1.execlous.exedescription pid process target process PID 1668 set thread context of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1836 set thread context of 556 1836 clous.exe clous.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
25d10c1c957744485ee6c6f68285e4a1.execlous.exedescription pid process Token: SeDebugPrivilege 1668 25d10c1c957744485ee6c6f68285e4a1.exe Token: SeDebugPrivilege 1836 clous.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
25d10c1c957744485ee6c6f68285e4a1.exe25d10c1c957744485ee6c6f68285e4a1.execlous.exedescription pid process target process PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 1668 wrote to memory of 2028 1668 25d10c1c957744485ee6c6f68285e4a1.exe 25d10c1c957744485ee6c6f68285e4a1.exe PID 2028 wrote to memory of 1836 2028 25d10c1c957744485ee6c6f68285e4a1.exe clous.exe PID 2028 wrote to memory of 1836 2028 25d10c1c957744485ee6c6f68285e4a1.exe clous.exe PID 2028 wrote to memory of 1836 2028 25d10c1c957744485ee6c6f68285e4a1.exe clous.exe PID 2028 wrote to memory of 1836 2028 25d10c1c957744485ee6c6f68285e4a1.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe PID 1836 wrote to memory of 556 1836 clous.exe clous.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\25d10c1c957744485ee6c6f68285e4a1.exe"C:\Users\Admin\AppData\Local\Temp\25d10c1c957744485ee6c6f68285e4a1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\25d10c1c957744485ee6c6f68285e4a1.exeC:\Users\Admin\AppData\Local\Temp\25d10c1c957744485ee6c6f68285e4a1.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\clous.exe"C:\ProgramData\clous.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\clous.exeC:\ProgramData\clous.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\clous.exeFilesize
800KB
MD525d10c1c957744485ee6c6f68285e4a1
SHA149673bbf62d6c73a1358ad2da2b803d6d96249cd
SHA256640cd3c54e536bc56eb35e4ab5a2b965b7d740fc13ac83b0a0d4237512ec56ef
SHA5124e27b9b6fe1c8fc22f284c46abdc88b9464b39d846f4fe0e6b1c813644f99ac41f481991d851b6b64eece690265eaeba0a65f2e5ba64486c31ed5c2d687103ca
-
C:\ProgramData\clous.exeFilesize
800KB
MD525d10c1c957744485ee6c6f68285e4a1
SHA149673bbf62d6c73a1358ad2da2b803d6d96249cd
SHA256640cd3c54e536bc56eb35e4ab5a2b965b7d740fc13ac83b0a0d4237512ec56ef
SHA5124e27b9b6fe1c8fc22f284c46abdc88b9464b39d846f4fe0e6b1c813644f99ac41f481991d851b6b64eece690265eaeba0a65f2e5ba64486c31ed5c2d687103ca
-
C:\ProgramData\clous.exeFilesize
800KB
MD525d10c1c957744485ee6c6f68285e4a1
SHA149673bbf62d6c73a1358ad2da2b803d6d96249cd
SHA256640cd3c54e536bc56eb35e4ab5a2b965b7d740fc13ac83b0a0d4237512ec56ef
SHA5124e27b9b6fe1c8fc22f284c46abdc88b9464b39d846f4fe0e6b1c813644f99ac41f481991d851b6b64eece690265eaeba0a65f2e5ba64486c31ed5c2d687103ca
-
\ProgramData\clous.exeFilesize
800KB
MD525d10c1c957744485ee6c6f68285e4a1
SHA149673bbf62d6c73a1358ad2da2b803d6d96249cd
SHA256640cd3c54e536bc56eb35e4ab5a2b965b7d740fc13ac83b0a0d4237512ec56ef
SHA5124e27b9b6fe1c8fc22f284c46abdc88b9464b39d846f4fe0e6b1c813644f99ac41f481991d851b6b64eece690265eaeba0a65f2e5ba64486c31ed5c2d687103ca
-
memory/556-75-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/556-76-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/556-71-0x0000000000405CE2-mapping.dmp
-
memory/1668-54-0x00000000011C0000-0x0000000001290000-memory.dmpFilesize
832KB
-
memory/1668-57-0x0000000000820000-0x0000000000826000-memory.dmpFilesize
24KB
-
memory/1668-56-0x0000000000FF0000-0x00000000010AE000-memory.dmpFilesize
760KB
-
memory/1668-55-0x0000000000910000-0x0000000000916000-memory.dmpFilesize
24KB
-
memory/1836-68-0x0000000000960000-0x0000000000A30000-memory.dmpFilesize
832KB
-
memory/1836-65-0x0000000000000000-mapping.dmp
-
memory/2028-58-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2028-69-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2028-63-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2028-62-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2028-61-0x0000000075071000-0x0000000075073000-memory.dmpFilesize
8KB
-
memory/2028-59-0x0000000000405CE2-mapping.dmp