Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:40
Static task
static1
Behavioral task
behavioral1
Sample
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Resource
win10v2004-20230220-en
General
-
Target
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
-
Size
1.2MB
-
MD5
8e735a4900673cdc83e38a3cf2a97e6e
-
SHA1
c9295752d06bf81ad03c6b9790126f91a18bf6cf
-
SHA256
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5
-
SHA512
d99ac448318eef34ce0bf6483a9926330aa3931e3f173ab8d46ef60b5bab27e849483e9fcbc8b699cd3fa698f7199a1e4a91beadafb7ee41565b04f36754ef00
-
SSDEEP
24576:qhXCYZNjSPZ8wMRbZOKK0CHTXrP3I2IvrrP3bfvFYlLEs2m:qhP3jxSdH7r422rTmesd
Malware Config
Extracted
warzonerat
buy.teamviewsoft.com:80
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4400-142-0x0000000004930000-0x0000000004A84000-memory.dmp warzonerat behavioral2/memory/4400-145-0x0000000004930000-0x0000000004A84000-memory.dmp warzonerat -
Drops startup file 2 IoCs
Processes:
DllHost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360seupdate.exe DllHost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\360seupdate.exe DllHost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 40 IoCs
Processes:
cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exepid process 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe 4400 cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe"C:\Users\Admin\AppData\Local\Temp\cac1c584865dc768d05e0252e96ae2101e3dcee23f0cfcac4c19ef56b9ff4fe5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{3AD05575-8857-4850-9277-11B85BDB8E09}1⤵
- Drops startup file
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4400-133-0x0000000000400000-0x000000000053A000-memory.dmpFilesize
1.2MB
-
memory/4400-134-0x0000000000810000-0x0000000000811000-memory.dmpFilesize
4KB
-
memory/4400-135-0x0000000003F60000-0x0000000003FDB000-memory.dmpFilesize
492KB
-
memory/4400-136-0x0000000000400000-0x000000000053A000-memory.dmpFilesize
1.2MB
-
memory/4400-137-0x0000000003F60000-0x0000000003FDB000-memory.dmpFilesize
492KB
-
memory/4400-141-0x0000000003FE0000-0x0000000004183000-memory.dmpFilesize
1.6MB
-
memory/4400-142-0x0000000004930000-0x0000000004A84000-memory.dmpFilesize
1.3MB
-
memory/4400-143-0x0000000000400000-0x000000000053A000-memory.dmpFilesize
1.2MB
-
memory/4400-145-0x0000000004930000-0x0000000004A84000-memory.dmpFilesize
1.3MB