Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 07:50
Static task
static1
Behavioral task
behavioral1
Sample
mb_mw.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
mb_mw.exe
Resource
win10v2004-20230220-en
General
-
Target
mb_mw.exe
-
Size
408KB
-
MD5
f9e2cba1859363981faf603e31397d16
-
SHA1
b12b61363d3150388ac554f0bc46d00106c9dfa6
-
SHA256
bad970e9402f9d346e7c58c42253bcedd6fb6ccda7115194ba9538153628778e
-
SHA512
60459a9d38a576d85198de144a8aa683acd06a8f8a94e44350cf5262d31a57262281fd9bd3a525a061c3cbd3331b30629357da164a49149df09e33bc5e0e3831
-
SSDEEP
6144:j0mi4eWGUSUm5FGNMgXDE6PXDsBRHJeqfqdNfN7nIhM1XDsBRHJeq:op4eWGRPgCADtzwHJev7hIhM1zwHJe
Malware Config
Extracted
warzonerat
46.183.222.62:5353
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/1444-136-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1444-139-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1444-140-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/1444-145-0x0000000000400000-0x000000000055C000-memory.dmp warzonerat behavioral2/memory/2616-154-0x0000000000980000-0x0000000000ADC000-memory.dmp warzonerat behavioral2/memory/2616-159-0x0000000000980000-0x0000000000ADC000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 2628 images.exe 2616 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
mb_mw.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe" mb_mw.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
mb_mw.exeimages.exedescription pid process target process PID 1176 set thread context of 1444 1176 mb_mw.exe mb_mw.exe PID 2628 set thread context of 2616 2628 images.exe images.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3560 2616 WerFault.exe images.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
mb_mw.exemb_mw.exeimages.exedescription pid process target process PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1176 wrote to memory of 1444 1176 mb_mw.exe mb_mw.exe PID 1444 wrote to memory of 2628 1444 mb_mw.exe images.exe PID 1444 wrote to memory of 2628 1444 mb_mw.exe images.exe PID 1444 wrote to memory of 2628 1444 mb_mw.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe PID 2628 wrote to memory of 2616 2628 images.exe images.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mb_mw.exe"C:\Users\Admin\AppData\Local\Temp\mb_mw.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mb_mw.exe"C:\Users\Admin\AppData\Local\Temp\mb_mw.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\images.exe"C:\Users\Admin\Documents\images.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2616 -s 5445⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 2616 -ip 26161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\images.exeFilesize
408KB
MD5f9e2cba1859363981faf603e31397d16
SHA1b12b61363d3150388ac554f0bc46d00106c9dfa6
SHA256bad970e9402f9d346e7c58c42253bcedd6fb6ccda7115194ba9538153628778e
SHA51260459a9d38a576d85198de144a8aa683acd06a8f8a94e44350cf5262d31a57262281fd9bd3a525a061c3cbd3331b30629357da164a49149df09e33bc5e0e3831
-
C:\Users\Admin\Documents\images.exeFilesize
408KB
MD5f9e2cba1859363981faf603e31397d16
SHA1b12b61363d3150388ac554f0bc46d00106c9dfa6
SHA256bad970e9402f9d346e7c58c42253bcedd6fb6ccda7115194ba9538153628778e
SHA51260459a9d38a576d85198de144a8aa683acd06a8f8a94e44350cf5262d31a57262281fd9bd3a525a061c3cbd3331b30629357da164a49149df09e33bc5e0e3831
-
C:\Users\Admin\Documents\images.exeFilesize
408KB
MD5f9e2cba1859363981faf603e31397d16
SHA1b12b61363d3150388ac554f0bc46d00106c9dfa6
SHA256bad970e9402f9d346e7c58c42253bcedd6fb6ccda7115194ba9538153628778e
SHA51260459a9d38a576d85198de144a8aa683acd06a8f8a94e44350cf5262d31a57262281fd9bd3a525a061c3cbd3331b30629357da164a49149df09e33bc5e0e3831
-
memory/1176-133-0x0000000000B20000-0x0000000000B8C000-memory.dmpFilesize
432KB
-
memory/1176-134-0x0000000005A40000-0x0000000005FE4000-memory.dmpFilesize
5.6MB
-
memory/1176-135-0x0000000005500000-0x0000000005566000-memory.dmpFilesize
408KB
-
memory/1444-136-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1444-139-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1444-140-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/1444-145-0x0000000000400000-0x000000000055C000-memory.dmpFilesize
1.4MB
-
memory/2616-154-0x0000000000980000-0x0000000000ADC000-memory.dmpFilesize
1.4MB
-
memory/2616-159-0x0000000000980000-0x0000000000ADC000-memory.dmpFilesize
1.4MB