Analysis
-
max time kernel
113s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
13-03-2023 07:10
Static task
static1
Behavioral task
behavioral1
Sample
8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe
Resource
win10v2004-20230220-en
General
-
Target
8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe
-
Size
177KB
-
MD5
877f6849ca8eb7a220d7bb64add71f44
-
SHA1
41550d90774094cc82fce79db394c0bbdaf9c269
-
SHA256
8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f
-
SHA512
cc71b1c3fd3fd4ec15a38f4fdb55e99a09964acf740e32b8093fb05ef23454ed4d2daa560db49c23bda1526f267ff292326585f1f06d31aa3bc866d3acbf256c
-
SSDEEP
3072:2fY/TU9fE9PEtuGbo74DhFVnHNrNRBpAnv++sKXzRHyuOV0AASZv7M5yg7u:gYa6Wo74FnHRBpAn7XzRHyu40AASZ6Ba
Malware Config
Extracted
warzonerat
macrim.duckdns.org:6269
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4516-143-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4516-146-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4516-148-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4516-149-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
izauc.exeizauc.exepid process 940 izauc.exe 4516 izauc.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
izauc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\njscwgclu = "C:\\Users\\Admin\\AppData\\Roaming\\fxsclh\\qmvfbktpyue.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\izauc.exe\" C:\\Users\\Admin\\AppData\\Local\\T" izauc.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
izauc.exedescription pid process target process PID 940 set thread context of 4516 940 izauc.exe izauc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
izauc.exepid process 940 izauc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
izauc.exepid process 4516 izauc.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exeizauc.exedescription pid process target process PID 3236 wrote to memory of 940 3236 8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe izauc.exe PID 3236 wrote to memory of 940 3236 8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe izauc.exe PID 3236 wrote to memory of 940 3236 8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe izauc.exe PID 940 wrote to memory of 4516 940 izauc.exe izauc.exe PID 940 wrote to memory of 4516 940 izauc.exe izauc.exe PID 940 wrote to memory of 4516 940 izauc.exe izauc.exe PID 940 wrote to memory of 4516 940 izauc.exe izauc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe"C:\Users\Admin\AppData\Local\Temp\8eb2f7ab9bab3a18b8e697ade5fa57a70f7200bb442179bb8761b9f2d876345f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Users\Admin\AppData\Local\Temp\izauc.exe"C:\Users\Admin\AppData\Local\Temp\izauc.exe" C:\Users\Admin\AppData\Local\Temp\htignl.m2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Users\Admin\AppData\Local\Temp\izauc.exe"C:\Users\Admin\AppData\Local\Temp\izauc.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\htignl.mFilesize
7KB
MD5f2b9c73413060e335b609dd176040df5
SHA1e096feacd831cb56c29b7e0bf876173630e9f2b0
SHA2567934d4d2a44a2557a8eda2ccc0e036083457b26d2876a786b862e9dbb6198fb8
SHA512926d62de9203dfe6be5cf265e9fbaaf0c26855a92efcce81f1879762eecc489f8009621adbae543132ad191f159d2edc7a4d536007f92a6da276ffae01e461fc
-
C:\Users\Admin\AppData\Local\Temp\izauc.exeFilesize
6KB
MD52a61906fbc67c26ba71fb8cf6140104b
SHA1ab3643a48e1752ec3e5737ff0adb484db6456555
SHA25635fd84ae72ac37f8c2e792e213a9cb3daf061e9405e708965282314333a5a3f6
SHA512656eae0355fb70aef9f8399d5fcf9c3ce30dd266b9e0a63dbfd19db87c939a74382b82842991d5957ff911fb715de39c3031f7e492ef79c38c442060ae5a97a1
-
C:\Users\Admin\AppData\Local\Temp\izauc.exeFilesize
6KB
MD52a61906fbc67c26ba71fb8cf6140104b
SHA1ab3643a48e1752ec3e5737ff0adb484db6456555
SHA25635fd84ae72ac37f8c2e792e213a9cb3daf061e9405e708965282314333a5a3f6
SHA512656eae0355fb70aef9f8399d5fcf9c3ce30dd266b9e0a63dbfd19db87c939a74382b82842991d5957ff911fb715de39c3031f7e492ef79c38c442060ae5a97a1
-
C:\Users\Admin\AppData\Local\Temp\izauc.exeFilesize
6KB
MD52a61906fbc67c26ba71fb8cf6140104b
SHA1ab3643a48e1752ec3e5737ff0adb484db6456555
SHA25635fd84ae72ac37f8c2e792e213a9cb3daf061e9405e708965282314333a5a3f6
SHA512656eae0355fb70aef9f8399d5fcf9c3ce30dd266b9e0a63dbfd19db87c939a74382b82842991d5957ff911fb715de39c3031f7e492ef79c38c442060ae5a97a1
-
C:\Users\Admin\AppData\Local\Temp\nympwzfdyqo.fpFilesize
118KB
MD5b016846f500b9fb6e1770163ec1ebedf
SHA1ebe46444dad433ae13d99f76cd68fa3b03ad1d74
SHA2567c88366d42ff2ec708825c88e6108f11d973638d90ab19a3879dbdd160fa8238
SHA5122a3064bf4da8990928af1f3dc525e85843b247c622e3d35d704a4f4c987e7392fc49c7c9a6e020e16f4f63a12f964eae6f381ca4f86c7a59cba4501d509c8282
-
memory/4516-143-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4516-146-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4516-148-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/4516-149-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB