Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 05:29
Static task
static1
Behavioral task
behavioral1
Sample
ungziped_file.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
ungziped_file.exe
Resource
win10v2004-20230220-en
General
-
Target
ungziped_file.exe
-
Size
254KB
-
MD5
8d93c0e9645dd3bddfb8f658c51dc1b3
-
SHA1
5f2744ef4f6f2930bc320382df3d23d06e7ae9d1
-
SHA256
cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
-
SHA512
682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
SSDEEP
3072:f66ea8jXuZ6bgAbd2wVH3R8LmzvzzfYuIWYCyXdgCLdCRaOVvVGb31fT0d5Ys:fKg6bgAEoB8LmznfYhWY0+JOm108
Malware Config
Extracted
warzonerat
91.193.75.142:5234
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 7 IoCs
Processes:
resource yara_rule behavioral2/memory/3184-136-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/3184-139-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/3184-140-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/3184-145-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/3456-150-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/3456-151-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/3456-154-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 4092 images.exe 3456 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ungziped_file.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe" ungziped_file.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ungziped_file.exeimages.exedescription pid process target process PID 1512 set thread context of 3184 1512 ungziped_file.exe ungziped_file.exe PID 4092 set thread context of 3456 4092 images.exe images.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
ungziped_file.exeungziped_file.exeimages.exeimages.exedescription pid process target process PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 1512 wrote to memory of 3184 1512 ungziped_file.exe ungziped_file.exe PID 3184 wrote to memory of 4092 3184 ungziped_file.exe images.exe PID 3184 wrote to memory of 4092 3184 ungziped_file.exe images.exe PID 3184 wrote to memory of 4092 3184 ungziped_file.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 4092 wrote to memory of 3456 4092 images.exe images.exe PID 3456 wrote to memory of 4308 3456 images.exe cmd.exe PID 3456 wrote to memory of 4308 3456 images.exe cmd.exe PID 3456 wrote to memory of 4308 3456 images.exe cmd.exe PID 3456 wrote to memory of 4308 3456 images.exe cmd.exe PID 3456 wrote to memory of 4308 3456 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"C:\Users\Admin\AppData\Local\Temp\ungziped_file.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
C:\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
C:\Users\Admin\Documents\images.exeFilesize
254KB
MD58d93c0e9645dd3bddfb8f658c51dc1b3
SHA15f2744ef4f6f2930bc320382df3d23d06e7ae9d1
SHA256cb6260c92a905ed173ed763ba1d6a02cce82dc0f3895e58e0a2c68b59572e078
SHA512682048622a97cd14898340c71c10795f1547b2a1c6b56a5add7e9582e5b6b66637da58a273ead3567bae8bc63d4875d4be5f516e4c7901dacaf81e52de4b4149
-
memory/1512-135-0x0000000004AA0000-0x0000000004B06000-memory.dmpFilesize
408KB
-
memory/1512-134-0x0000000004FA0000-0x0000000005544000-memory.dmpFilesize
5.6MB
-
memory/1512-133-0x00000000000F0000-0x0000000000134000-memory.dmpFilesize
272KB
-
memory/3184-136-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/3184-139-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/3184-140-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/3184-145-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/3456-150-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/3456-151-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/3456-154-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/4308-152-0x0000000001210000-0x0000000001211000-memory.dmpFilesize
4KB