Analysis
-
max time kernel
147s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
28/03/2023, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Resource
win10v2004-20230220-en
General
-
Target
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
-
Size
1.2MB
-
MD5
8e735a4900673cdc83e38a3cf2a97e6e
-
SHA1
c9295752d06bf81ad03c6b9790126f91a18bf6cf
-
SHA256
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5
-
SHA512
d99ac448318eef34ce0bf6483a9926330aa3931e3f173ab8d46ef60b5bab27e849483e9fcbc8b699cd3fa698f7199a1e4a91beadafb7ee41565b04f36754ef00
-
SSDEEP
24576:qhXCYZNjSPZ8wMRbZOKK0CHTXrP3I2IvrrP3bfvFYlLEs2m:qhP3jxSdH7r422rTmesd
Malware Config
Extracted
warzonerat
buy.teamviewsoft.com:80
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 1 IoCs
resource yara_rule behavioral1/memory/748-63-0x00000000037F0000-0x0000000003944000-memory.dmp warzonerat -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360seupdate.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 748 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe"C:\Users\Admin\AppData\Local\Temp\cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
PID:748
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
PID:880