Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2023, 01:45

General

  • Target

    6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe

  • Size

    215KB

  • MD5

    5d278b330412fc5f0b05a6168e4663f7

  • SHA1

    afebf776b4cdcfa12dc38d7aab0190820a956057

  • SHA256

    6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e

  • SHA512

    4c7204ac871350fcb6c4e4a745fd2f7482afa152e0cdd7e4097aaa427d1911b6fe038b366cba5acad1243e209643634c2ea48ad4c613a34c2488eb1fcf3ef275

  • SSDEEP

    3072:2fY/TU9fE9PEtuFbzrF+aj3dFzFNqdTGi7Gb2QmBAZdWlqLGCZM4fNmBvqNxHFgz:gYa6XzrFrbDqVGd6AZdwINmlq1gqg

Malware Config

Extracted

Family

warzonerat

C2

osairus.duckdns.org:4244

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe
    "C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe"
    1⤵
    • Loads dropped DLL
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:1280
    • C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe
      "C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe"
      2⤵
        PID:2280

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nslCB55.tmp\dpvhuhc.dll

      Filesize

      86KB

      MD5

      1627f1115a794fbec36c674297f31fb4

      SHA1

      7cbd5122f668be131d041395c462c1cfea76c1f0

      SHA256

      c6d8e109a8a3b7d4944fd258ab065229decaad0daa1e9a0007c34119158d6af9

      SHA512

      811f820f0ef8ace011c2b9f8bae613ed040aaaf49888609d9043184c5f17393ea3281ba266b25693ab96f22dc94e69f475be761d41eb5dfee9afce8637038e24

    • memory/1280-143-0x0000000003270000-0x0000000003273000-memory.dmp

      Filesize

      12KB

    • memory/2280-140-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2280-142-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB

    • memory/2280-144-0x0000000000400000-0x000000000041D000-memory.dmp

      Filesize

      116KB