Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/02/2023, 14:45

General

  • Target

    E&V - PO.61370025177.exe

  • Size

    903KB

  • MD5

    cc2e6a027d9a95e1b2df73f1b0350107

  • SHA1

    0d0899b4940db158978fa66d92e40e0c013d3e1d

  • SHA256

    e9575a5decf464c96451e7e6f2f4a12e2c0f96729bc25885507913ede49cb784

  • SHA512

    33721debe49429d2b561add911f7e03d916e9a5990fdda7e0ea4ede1f911b0d723d41a9cb0721066b64ce784604671b0ec63bcc118c1632da6601f3d9347747a

  • SSDEEP

    24576:j9JiT/gnOmk/3T911111111111111dODiRu4N:2gny11111111111111GiR5

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs ping.exe 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\E&V - PO.61370025177.exe
    "C:\Users\Admin\AppData\Local\Temp\E&V - PO.61370025177.exe"
    1⤵
    • Drops startup file
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2068
    • C:\Windows\SysWOW64\cmd.exe
      "cmd" /c ping 127.0.0.1 -n 14 > nul && copy "C:\Users\Admin\AppData\Local\Temp\E&V - PO.61370025177.exe" "C:\Users\Admin\AppData\Roaming\kdiurdjk.exe" && ping 127.0.0.1 -n 14 > nul && "C:\Users\Admin\AppData\Roaming\kdiurdjk.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 14
        3⤵
        • Runs ping.exe
        PID:2744
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1 -n 14
        3⤵
        • Runs ping.exe
        PID:1360
      • C:\Users\Admin\AppData\Roaming\kdiurdjk.exe
        "C:\Users\Admin\AppData\Roaming\kdiurdjk.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1080
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          4⤵
          • Sets DLL path for service in the registry
          • Drops file in System32 directory
          • Drops file in Program Files directory
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2324
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe"
            5⤵
              PID:2164
            • C:\Users\Admin\AppData\Local\Temp\47.exe
              "C:\Users\Admin\AppData\Local\Temp\47.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3112
              • C:\Windows\SysWOW64\netsh.exe
                netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
                6⤵
                • Modifies Windows Firewall
                PID:4128
          • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe
            "C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe"
            4⤵
            • Checks computer location settings
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1616
            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe
              "C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious use of AdjustPrivilegeToken
              PID:4632
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x4a0 0x458
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1548
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -s TermService
      1⤵
        PID:4400
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -s TermService
        1⤵
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:4720

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files\Microsoft DN1\sqlmap.dll

              Filesize

              114KB

              MD5

              461ade40b800ae80a40985594e1ac236

              SHA1

              b3892eef846c044a2b0785d54a432b3e93a968c8

              SHA256

              798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

              SHA512

              421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

            • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Xapfnzes.exe.log

              Filesize

              1KB

              MD5

              7dca233df92b3884663fa5a40db8d49c

              SHA1

              208b8f27b708c4e06ac37f974471cc7b29c29b60

              SHA256

              90c83311e35da0b5f8aa65aa2109745feb68ee9540e863f4ed909872e9c6a84c

              SHA512

              d134b96fd33c79c85407608f76afc5a9f937bff453b1c90727a3ed992006c7d4c8329be6a2b5ba6b11da1a32f7cd60e9bc380be388b586d6cd5c2e6b1f57bd07

            • C:\Users\Admin\AppData\Local\Temp\47.exe

              Filesize

              70KB

              MD5

              ca96229390a0e6a53e8f2125f2c01114

              SHA1

              a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

              SHA256

              0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

              SHA512

              e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

            • C:\Users\Admin\AppData\Local\Temp\47.exe

              Filesize

              70KB

              MD5

              ca96229390a0e6a53e8f2125f2c01114

              SHA1

              a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

              SHA256

              0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

              SHA512

              e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

            • C:\Users\Admin\AppData\Local\Temp\47.exe

              Filesize

              70KB

              MD5

              ca96229390a0e6a53e8f2125f2c01114

              SHA1

              a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

              SHA256

              0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

              SHA512

              e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe

              Filesize

              76KB

              MD5

              0e362e7005823d0bec3719b902ed6d62

              SHA1

              590d860b909804349e0cdc2f1662b37bd62f7463

              SHA256

              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

              SHA512

              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe

              Filesize

              76KB

              MD5

              0e362e7005823d0bec3719b902ed6d62

              SHA1

              590d860b909804349e0cdc2f1662b37bd62f7463

              SHA256

              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

              SHA512

              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe

              Filesize

              76KB

              MD5

              0e362e7005823d0bec3719b902ed6d62

              SHA1

              590d860b909804349e0cdc2f1662b37bd62f7463

              SHA256

              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

              SHA512

              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.exe

              Filesize

              76KB

              MD5

              0e362e7005823d0bec3719b902ed6d62

              SHA1

              590d860b909804349e0cdc2f1662b37bd62f7463

              SHA256

              2d0dc6216f613ac7551a7e70a798c22aee8eb9819428b1357e2b8c73bef905ad

              SHA512

              518991b68496b3f8545e418cf9b345e0791e09cc20d177b8aa47e0aba447aa55383c64f5bdaca39f2b061a5d08c16f2ad484af8a9f238ca23ab081618fba3ad3

            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.txt

              Filesize

              54B

              MD5

              650efd7432b59f2e927dd54cc5a930e8

              SHA1

              0e856cf8f56def81d2b589de0fbbdf801e8416b7

              SHA256

              70aa8ccc92cffe750a10010d7c7014246ffc61e581472a179a420d8223ae0e51

              SHA512

              5a8b99a16bbf9ca3da698a37581e3af49a7e7f713f2c9c5b94831873f97f8da7677156384e0ac215bdb2d6d505cca1cdfc14f211738c1511eb674d635e6b7725

            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.txt

              Filesize

              57B

              MD5

              9c0f3f56bf8ac8c93a1f71554eb39916

              SHA1

              523237b53c1246af1be877290013c79eb6f57f0d

              SHA256

              c541b41ee2e53cc17a05dd5e78a949f69cd10215be8e675ef08be07fd6c0cd86

              SHA512

              d040577b76484cfde408c83d0e9626c6622f472073db5aa1df810c107f2aa38a8114dc82bb8aa525be792a4a7a82d26e9b1a6e66da56513974468561312795f8

            • C:\Users\Admin\AppData\Local\Temp\Xapfnzes.txt

              Filesize

              57B

              MD5

              9c0f3f56bf8ac8c93a1f71554eb39916

              SHA1

              523237b53c1246af1be877290013c79eb6f57f0d

              SHA256

              c541b41ee2e53cc17a05dd5e78a949f69cd10215be8e675ef08be07fd6c0cd86

              SHA512

              d040577b76484cfde408c83d0e9626c6622f472073db5aa1df810c107f2aa38a8114dc82bb8aa525be792a4a7a82d26e9b1a6e66da56513974468561312795f8

            • C:\Users\Admin\AppData\Roaming\kdiurdjk.exe

              Filesize

              903KB

              MD5

              cc2e6a027d9a95e1b2df73f1b0350107

              SHA1

              0d0899b4940db158978fa66d92e40e0c013d3e1d

              SHA256

              e9575a5decf464c96451e7e6f2f4a12e2c0f96729bc25885507913ede49cb784

              SHA512

              33721debe49429d2b561add911f7e03d916e9a5990fdda7e0ea4ede1f911b0d723d41a9cb0721066b64ce784604671b0ec63bcc118c1632da6601f3d9347747a

            • C:\Users\Admin\AppData\Roaming\kdiurdjk.exe

              Filesize

              903KB

              MD5

              cc2e6a027d9a95e1b2df73f1b0350107

              SHA1

              0d0899b4940db158978fa66d92e40e0c013d3e1d

              SHA256

              e9575a5decf464c96451e7e6f2f4a12e2c0f96729bc25885507913ede49cb784

              SHA512

              33721debe49429d2b561add911f7e03d916e9a5990fdda7e0ea4ede1f911b0d723d41a9cb0721066b64ce784604671b0ec63bcc118c1632da6601f3d9347747a

            • \??\c:\program files\microsoft dn1\rdpwrap.ini

              Filesize

              299KB

              MD5

              fca6ba93c780afa00a5703df9ac65754

              SHA1

              3ed423763fdd9722ff8bed3667ffa93f77390138

              SHA256

              1c4930123ec2a809b3bd93969967d6c321d8d65fc7b886e062b2581c741944e5

              SHA512

              538b0995be3796737575a2fd3aaa1644b3e6566e4cd5ed5c4df9e0a586368e7ceea8f0284de53f7c3f0874fc90b9a194d2ea1438bc9d7779eb12d00b8807f595

            • \??\c:\program files\microsoft dn1\sqlmap.dll

              Filesize

              114KB

              MD5

              461ade40b800ae80a40985594e1ac236

              SHA1

              b3892eef846c044a2b0785d54a432b3e93a968c8

              SHA256

              798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

              SHA512

              421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

            • memory/1080-156-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1080-149-0x00000000004E0000-0x00000000005C8000-memory.dmp

              Filesize

              928KB

            • memory/1080-154-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1080-157-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1080-153-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1080-152-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1080-155-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1080-151-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1080-150-0x0000000004C10000-0x0000000004C20000-memory.dmp

              Filesize

              64KB

            • memory/1616-174-0x0000000000740000-0x000000000075A000-memory.dmp

              Filesize

              104KB

            • memory/2068-133-0x0000000000960000-0x0000000000A48000-memory.dmp

              Filesize

              928KB

            • memory/2068-142-0x00000000058C0000-0x00000000058D0000-memory.dmp

              Filesize

              64KB

            • memory/2068-140-0x00000000058C0000-0x00000000058D0000-memory.dmp

              Filesize

              64KB

            • memory/2068-139-0x00000000058C0000-0x00000000058D0000-memory.dmp

              Filesize

              64KB

            • memory/2068-138-0x0000000002F40000-0x0000000002F4A000-memory.dmp

              Filesize

              40KB

            • memory/2068-137-0x00000000058C0000-0x00000000058D0000-memory.dmp

              Filesize

              64KB

            • memory/2068-136-0x00000000056B0000-0x000000000574C000-memory.dmp

              Filesize

              624KB

            • memory/2068-135-0x0000000005610000-0x00000000056A2000-memory.dmp

              Filesize

              584KB

            • memory/2068-134-0x0000000005D30000-0x00000000062D4000-memory.dmp

              Filesize

              5.6MB

            • memory/2164-182-0x0000000000C10000-0x0000000000C11000-memory.dmp

              Filesize

              4KB

            • memory/2324-162-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/2324-187-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/2324-184-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/2324-163-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/2324-161-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/2324-158-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/2324-204-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/2324-208-0x0000000000400000-0x000000000055C000-memory.dmp

              Filesize

              1.4MB

            • memory/3112-200-0x0000000000250000-0x000000000027D000-memory.dmp

              Filesize

              180KB

            • memory/3112-206-0x0000000000250000-0x000000000027D000-memory.dmp

              Filesize

              180KB