Analysis

  • max time kernel
    142s
  • max time network
    142s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2023, 09:41

General

  • Target

    50695a48edcc2576675a4d862311b28b.exe

  • Size

    222KB

  • MD5

    50695a48edcc2576675a4d862311b28b

  • SHA1

    1e390ccab122caa7f1c396ed0325cdc572a65946

  • SHA256

    918bd8df4133a9c6a279757baf27e33ce33c0d115e405178c4563a556e26b647

  • SHA512

    6b927a88973641ceaab1ae01bd80414d540f14d408435f9aee1a387e5f190d42272a9c6e6a873573547a45df3f7b041cbbc148360e528fbe948e52578009d789

  • SSDEEP

    3072:/fY/TU9fE9PEtuZsbZUeHbkZUHZ+rINhqX+E13rGowgdMoTnqFiDyJvS+sr3vPPH:XYa6HOZUtFwlMrxwgUYGts7PwhtxY

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Modifies Windows Firewall 1 TTPs 2 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 5 IoCs
  • UPX packed file 9 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Modifies WinLogon 2 TTPs 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: LoadsDriver 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 25 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\50695a48edcc2576675a4d862311b28b.exe
    "C:\Users\Admin\AppData\Local\Temp\50695a48edcc2576675a4d862311b28b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe
      "C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe" C:\Users\Admin\AppData\Local\Temp\xmfqciidksw.w
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe
        "C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe"
        3⤵
        • Sets DLL path for service in the registry
        • Executes dropped EXE
        • Loads dropped DLL
        • Modifies WinLogon
        • Drops file in System32 directory
        • Drops file in Program Files directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:544
        • C:\Users\Admin\AppData\Local\Temp\350.exe
          "C:\Users\Admin\AppData\Local\Temp\350.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:2004
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
            5⤵
            • Modifies Windows Firewall
            PID:580
        • C:\Users\Admin\AppData\Local\Temp\350.exe
          "C:\Users\Admin\AppData\Local\Temp\350.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:1148
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
            5⤵
            • Modifies Windows Firewall
            PID:320

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\350.exe

          Filesize

          70KB

          MD5

          ca96229390a0e6a53e8f2125f2c01114

          SHA1

          a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

          SHA256

          0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

          SHA512

          e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

        • C:\Users\Admin\AppData\Local\Temp\350.exe

          Filesize

          70KB

          MD5

          ca96229390a0e6a53e8f2125f2c01114

          SHA1

          a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

          SHA256

          0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

          SHA512

          e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

        • C:\Users\Admin\AppData\Local\Temp\350.exe

          Filesize

          70KB

          MD5

          ca96229390a0e6a53e8f2125f2c01114

          SHA1

          a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

          SHA256

          0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

          SHA512

          e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

        • C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe

          Filesize

          60KB

          MD5

          7e14ab7fdec2ba5ca24b6a3af21c430b

          SHA1

          8621b145ec2936a18a57ec5296c7b3ed088ba692

          SHA256

          85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e

          SHA512

          3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06

        • C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe

          Filesize

          60KB

          MD5

          7e14ab7fdec2ba5ca24b6a3af21c430b

          SHA1

          8621b145ec2936a18a57ec5296c7b3ed088ba692

          SHA256

          85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e

          SHA512

          3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06

        • C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe

          Filesize

          60KB

          MD5

          7e14ab7fdec2ba5ca24b6a3af21c430b

          SHA1

          8621b145ec2936a18a57ec5296c7b3ed088ba692

          SHA256

          85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e

          SHA512

          3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06

        • C:\Users\Admin\AppData\Local\Temp\lfdaorq.t

          Filesize

          161KB

          MD5

          6bf7158a9b5dc387e0dd79895abf1e52

          SHA1

          4dbffcaf9ea9b37d32b173af246532a13f71d1a6

          SHA256

          aef63c8e0201a2975249852a6c7a11f256e615020ac04b5c31a5906b2bd30d2a

          SHA512

          3aa3926ca6a8a772f66193a5a590720205f40b13656990935abcad1ac2faff6dad71f15bf1558fbd807d9479ece65da26181dbdc3ee88de59081ccc344c7f1b5

        • C:\Users\Admin\AppData\Local\Temp\xmfqciidksw.w

          Filesize

          8KB

          MD5

          0407fc904cad9de15d803cb22985308a

          SHA1

          047eb49d90a212bd61ff6fa8b0f813e6899a0f3d

          SHA256

          238df51fccc66a32a3d082766a3642939a4422c6ed658936d2e365dbcc7cb264

          SHA512

          3625e85b843f378ea18dc2d5ec66fbbf96784cfc5ceb5a93e90249fab9ec25dd1ba84ff1c7d6329d53fc6e97338f90e59f53c21110f117e424c9b2054dff8055

        • \Program Files\Microsoft DN1\sqlmap.dll

          Filesize

          114KB

          MD5

          461ade40b800ae80a40985594e1ac236

          SHA1

          b3892eef846c044a2b0785d54a432b3e93a968c8

          SHA256

          798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

          SHA512

          421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

        • \Users\Admin\AppData\Local\Temp\350.exe

          Filesize

          70KB

          MD5

          ca96229390a0e6a53e8f2125f2c01114

          SHA1

          a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

          SHA256

          0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

          SHA512

          e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

        • \Users\Admin\AppData\Local\Temp\350.exe

          Filesize

          70KB

          MD5

          ca96229390a0e6a53e8f2125f2c01114

          SHA1

          a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

          SHA256

          0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

          SHA512

          e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

        • \Users\Admin\AppData\Local\Temp\giuiwxga.exe

          Filesize

          60KB

          MD5

          7e14ab7fdec2ba5ca24b6a3af21c430b

          SHA1

          8621b145ec2936a18a57ec5296c7b3ed088ba692

          SHA256

          85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e

          SHA512

          3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06

        • \Users\Admin\AppData\Local\Temp\giuiwxga.exe

          Filesize

          60KB

          MD5

          7e14ab7fdec2ba5ca24b6a3af21c430b

          SHA1

          8621b145ec2936a18a57ec5296c7b3ed088ba692

          SHA256

          85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e

          SHA512

          3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06

        • memory/544-86-0x0000000004F80000-0x0000000004FAD000-memory.dmp

          Filesize

          180KB

        • memory/544-104-0x0000000000400000-0x000000000055C000-memory.dmp

          Filesize

          1.4MB

        • memory/544-73-0x0000000000400000-0x000000000055C000-memory.dmp

          Filesize

          1.4MB

        • memory/544-66-0x0000000000400000-0x000000000055C000-memory.dmp

          Filesize

          1.4MB

        • memory/544-111-0x0000000000400000-0x000000000055C000-memory.dmp

          Filesize

          1.4MB

        • memory/544-72-0x0000000000400000-0x000000000055C000-memory.dmp

          Filesize

          1.4MB

        • memory/544-71-0x0000000000400000-0x000000000055C000-memory.dmp

          Filesize

          1.4MB

        • memory/544-99-0x0000000005140000-0x000000000516D000-memory.dmp

          Filesize

          180KB

        • memory/544-106-0x0000000005140000-0x000000000516D000-memory.dmp

          Filesize

          180KB

        • memory/544-75-0x0000000000400000-0x000000000055C000-memory.dmp

          Filesize

          1.4MB

        • memory/1148-100-0x0000000000810000-0x000000000083D000-memory.dmp

          Filesize

          180KB

        • memory/1148-109-0x0000000000810000-0x000000000083D000-memory.dmp

          Filesize

          180KB

        • memory/1900-67-0x0000000000110000-0x0000000000113000-memory.dmp

          Filesize

          12KB

        • memory/2004-108-0x0000000000810000-0x000000000083D000-memory.dmp

          Filesize

          180KB

        • memory/2004-87-0x0000000000810000-0x000000000083D000-memory.dmp

          Filesize

          180KB