Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28-03-2023 08:40
Static task
static1
Behavioral task
behavioral1
Sample
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Resource
win10v2004-20230220-en
General
-
Target
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
-
Size
1.2MB
-
MD5
8e735a4900673cdc83e38a3cf2a97e6e
-
SHA1
c9295752d06bf81ad03c6b9790126f91a18bf6cf
-
SHA256
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5
-
SHA512
d99ac448318eef34ce0bf6483a9926330aa3931e3f173ab8d46ef60b5bab27e849483e9fcbc8b699cd3fa698f7199a1e4a91beadafb7ee41565b04f36754ef00
-
SSDEEP
24576:qhXCYZNjSPZ8wMRbZOKK0CHTXrP3I2IvrrP3bfvFYlLEs2m:qhP3jxSdH7r422rTmesd
Malware Config
Extracted
warzonerat
buy.teamviewsoft.com:80
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/748-63-0x00000000037F0000-0x0000000003944000-memory.dmp warzonerat -
Drops startup file 1 IoCs
Processes:
DllHost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360seupdate.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exepid process 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe"C:\Users\Admin\AppData\Local\Temp\cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/748-54-0x0000000000400000-0x000000000053A000-memory.dmpFilesize
1.2MB
-
memory/748-55-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/748-56-0x00000000020B0000-0x000000000212B000-memory.dmpFilesize
492KB
-
memory/748-58-0x00000000020B0000-0x000000000212B000-memory.dmpFilesize
492KB
-
memory/748-62-0x0000000002EB0000-0x0000000003030000-memory.dmpFilesize
1.5MB
-
memory/748-63-0x00000000037F0000-0x0000000003944000-memory.dmpFilesize
1.3MB
-
memory/748-64-0x0000000000400000-0x000000000053A000-memory.dmpFilesize
1.2MB