Analysis
- max time kernel
156s - max time network
167s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system - submitted
21/03/2023, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe
Resource
win7-20230220-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe
- Size 18KB
- Sample230321-qpl6dsae38
- SHA256 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012
- MD5 0be9c9de62ce0696daf9230cb5603ad9
- SHA1 4058637baa85bbd6d10b8919b45341a712fc9004
- SHA512 1ba30334398dbf72a11d57cc781419faa7d9100d288ac9f09d1a1d16466aad226235eff6277c071e63980c4c2aac8ad467f0376fcb28a355616a661d7324ba95
- SSDEEP 384:EzRd+2oW9S6/x47DBh3OcMCkd1N7/lbjRE7XxSfw2:9W9S6/W7DBJOcMCkd1BRRmXJ
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
45.72.96.199:55081
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/memory/1832-142-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1832-144-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1832-145-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1832-146-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 5060 set thread context of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 - Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 5060 wrote to memory of 744 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 93 PID 5060 wrote to memory of 744 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 93 PID 5060 wrote to memory of 744 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 93 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94 PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"2⤵PID:744
-
-
C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"2⤵PID:1832
-