Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
24-03-2023 13:11
Static task
static1
Behavioral task
behavioral1
Sample
z63DATASHEET.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
z63DATASHEET.exe
Resource
win10v2004-20230221-en
General
-
Target
z63DATASHEET.exe
-
Size
161KB
-
MD5
63bd8934c91736c0730f84dc84ac65f7
-
SHA1
d44d2435eda49dc2706b7b5219898ef6d86689c3
-
SHA256
85490cf0fc3a4ab7db8b39dae6b341a4f99aec3f84ed12816f85759aea900e74
-
SHA512
a9ee8fb5c2130c0f445e7510c06372d72638087019016a2adb7d9f0619d66bae3c3e36aacbfba21fc1c8841c52c9b6f58ffe337646594c2d8d18f4296795c32d
-
SSDEEP
3072:x8r8NJzhdWVl7nqHHdiFSBFRRwh9J9vZiEPUv6S0:xw81nKl7srF7whVhHUS
Malware Config
Extracted
warzonerat
91.193.75.142:5234
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-58-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1968-59-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1968-60-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1968-62-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1968-64-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1968-66-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1968-67-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1968-74-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral1/memory/1940-91-0x00000000004B0000-0x000000000060C000-memory.dmp warzonerat behavioral1/memory/1940-96-0x00000000004B0000-0x000000000060C000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 1876 images.exe 1940 images.exe -
Loads dropped DLL 1 IoCs
Processes:
z63DATASHEET.exepid process 1968 z63DATASHEET.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
z63DATASHEET.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe" z63DATASHEET.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
z63DATASHEET.exeimages.exedescription pid process target process PID 1368 set thread context of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1876 set thread context of 1940 1876 images.exe images.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
z63DATASHEET.exez63DATASHEET.exeimages.exeimages.exedescription pid process target process PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1368 wrote to memory of 1968 1368 z63DATASHEET.exe z63DATASHEET.exe PID 1968 wrote to memory of 1876 1968 z63DATASHEET.exe images.exe PID 1968 wrote to memory of 1876 1968 z63DATASHEET.exe images.exe PID 1968 wrote to memory of 1876 1968 z63DATASHEET.exe images.exe PID 1968 wrote to memory of 1876 1968 z63DATASHEET.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1876 wrote to memory of 1940 1876 images.exe images.exe PID 1940 wrote to memory of 1128 1940 images.exe cmd.exe PID 1940 wrote to memory of 1128 1940 images.exe cmd.exe PID 1940 wrote to memory of 1128 1940 images.exe cmd.exe PID 1940 wrote to memory of 1128 1940 images.exe cmd.exe PID 1940 wrote to memory of 1128 1940 images.exe cmd.exe PID 1940 wrote to memory of 1128 1940 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\z63DATASHEET.exe"C:\Users\Admin\AppData\Local\Temp\z63DATASHEET.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\z63DATASHEET.exe"C:\Users\Admin\AppData\Local\Temp\z63DATASHEET.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\images.exeFilesize
161KB
MD563bd8934c91736c0730f84dc84ac65f7
SHA1d44d2435eda49dc2706b7b5219898ef6d86689c3
SHA25685490cf0fc3a4ab7db8b39dae6b341a4f99aec3f84ed12816f85759aea900e74
SHA512a9ee8fb5c2130c0f445e7510c06372d72638087019016a2adb7d9f0619d66bae3c3e36aacbfba21fc1c8841c52c9b6f58ffe337646594c2d8d18f4296795c32d
-
C:\Users\Admin\Documents\images.exeFilesize
161KB
MD563bd8934c91736c0730f84dc84ac65f7
SHA1d44d2435eda49dc2706b7b5219898ef6d86689c3
SHA25685490cf0fc3a4ab7db8b39dae6b341a4f99aec3f84ed12816f85759aea900e74
SHA512a9ee8fb5c2130c0f445e7510c06372d72638087019016a2adb7d9f0619d66bae3c3e36aacbfba21fc1c8841c52c9b6f58ffe337646594c2d8d18f4296795c32d
-
C:\Users\Admin\Documents\images.exeFilesize
161KB
MD563bd8934c91736c0730f84dc84ac65f7
SHA1d44d2435eda49dc2706b7b5219898ef6d86689c3
SHA25685490cf0fc3a4ab7db8b39dae6b341a4f99aec3f84ed12816f85759aea900e74
SHA512a9ee8fb5c2130c0f445e7510c06372d72638087019016a2adb7d9f0619d66bae3c3e36aacbfba21fc1c8841c52c9b6f58ffe337646594c2d8d18f4296795c32d
-
\Users\Admin\Documents\images.exeFilesize
161KB
MD563bd8934c91736c0730f84dc84ac65f7
SHA1d44d2435eda49dc2706b7b5219898ef6d86689c3
SHA25685490cf0fc3a4ab7db8b39dae6b341a4f99aec3f84ed12816f85759aea900e74
SHA512a9ee8fb5c2130c0f445e7510c06372d72638087019016a2adb7d9f0619d66bae3c3e36aacbfba21fc1c8841c52c9b6f58ffe337646594c2d8d18f4296795c32d
-
memory/1128-98-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1128-97-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/1368-54-0x0000000000E40000-0x0000000000E6E000-memory.dmpFilesize
184KB
-
memory/1368-61-0x0000000004A40000-0x0000000004A80000-memory.dmpFilesize
256KB
-
memory/1876-75-0x0000000000280000-0x00000000002AE000-memory.dmpFilesize
184KB
-
memory/1940-83-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1940-91-0x00000000004B0000-0x000000000060C000-memory.dmpFilesize
1.4MB
-
memory/1940-96-0x00000000004B0000-0x000000000060C000-memory.dmpFilesize
1.4MB
-
memory/1968-60-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-62-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1968-74-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-64-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-59-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-58-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-57-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-67-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-66-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-56-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1968-55-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB