Analysis
-
max time kernel
156s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 13:26
Static task
static1
Behavioral task
behavioral1
Sample
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe
Resource
win10v2004-20230220-en
General
-
Target
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe
-
Size
18KB
-
MD5
0be9c9de62ce0696daf9230cb5603ad9
-
SHA1
4058637baa85bbd6d10b8919b45341a712fc9004
-
SHA256
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012
-
SHA512
1ba30334398dbf72a11d57cc781419faa7d9100d288ac9f09d1a1d16466aad226235eff6277c071e63980c4c2aac8ad467f0376fcb28a355616a661d7324ba95
-
SSDEEP
384:EzRd+2oW9S6/x47DBh3OcMCkd1N7/lbjRE7XxSfw2:9W9S6/W7DBJOcMCkd1BRRmXJ
Malware Config
Extracted
warzonerat
45.72.96.199:55081
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1832-142-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1832-144-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1832-145-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1832-146-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat -
Drops startup file 2 IoCs
Processes:
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exedescription pid process target process PID 5060 set thread context of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe -
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exepid process 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exedescription pid process Token: SeDebugPrivilege 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exedescription pid process target process PID 5060 wrote to memory of 744 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 744 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 744 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe PID 5060 wrote to memory of 1832 5060 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe 9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"C:\Users\Admin\AppData\Local\Temp\9675c26063960c74114460aa260684a0de5474930ab239b44afe8fba6ad4e012.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1832-142-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1832-144-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1832-145-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1832-146-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/5060-133-0x0000000000920000-0x000000000092A000-memory.dmpFilesize
40KB
-
memory/5060-134-0x0000000005880000-0x0000000005E24000-memory.dmpFilesize
5.6MB
-
memory/5060-135-0x0000000005370000-0x0000000005402000-memory.dmpFilesize
584KB
-
memory/5060-136-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/5060-137-0x00000000052F0000-0x00000000052FA000-memory.dmpFilesize
40KB
-
memory/5060-138-0x0000000005510000-0x0000000005520000-memory.dmpFilesize
64KB
-
memory/5060-139-0x00000000073E0000-0x000000000747C000-memory.dmpFilesize
624KB
-
memory/5060-140-0x0000000007480000-0x00000000074E6000-memory.dmpFilesize
408KB