Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/01/2024, 05:46

General

  • Target

    796dac6ac117343d0bd4708a8c3ad214.exe

  • Size

    1.0MB

  • MD5

    796dac6ac117343d0bd4708a8c3ad214

  • SHA1

    7b2a868868ccb1f6d6215aea86cd95ee0c37146f

  • SHA256

    899a0a25423c5c477dcb28a3875c69e659c186212548f7256d0c742ec8cc5f1f

  • SHA512

    14f1cffd5a157a8acdd2d8c2ff6ea514afb653a480ce829bae9336f82db4d1815ddaadf9161d3ac82d35d7017885a6b735b04fb006423c7442f456931e78a7eb

  • SSDEEP

    12288:Pyelr1qy7aEVug/pKPYcVmWbWyj0QLHpXwFhInPo4ERsqS:Pfd1qyaEVuRPQnyjT1wzInP

Malware Config

Extracted

Family

warzonerat

C2

91.92.120.132:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 4 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe
    "C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1760
    • C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe
      "C:\Users\Admin\AppData\Local\Temp\796dac6ac117343d0bd4708a8c3ad214.exe"
      2⤵
        PID:4352

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1760-8-0x0000000005AB0000-0x0000000005ACE000-memory.dmp

      Filesize

      120KB

    • memory/1760-10-0x0000000005810000-0x0000000005820000-memory.dmp

      Filesize

      64KB

    • memory/1760-2-0x0000000005480000-0x000000000551C000-memory.dmp

      Filesize

      624KB

    • memory/1760-3-0x0000000005AD0000-0x0000000006074000-memory.dmp

      Filesize

      5.6MB

    • memory/1760-4-0x00000000055C0000-0x0000000005652000-memory.dmp

      Filesize

      584KB

    • memory/1760-5-0x0000000005810000-0x0000000005820000-memory.dmp

      Filesize

      64KB

    • memory/1760-6-0x0000000005570000-0x000000000557A000-memory.dmp

      Filesize

      40KB

    • memory/1760-7-0x0000000005820000-0x0000000005876000-memory.dmp

      Filesize

      344KB

    • memory/1760-1-0x0000000074AA0000-0x0000000075250000-memory.dmp

      Filesize

      7.7MB

    • memory/1760-0-0x00000000009D0000-0x0000000000AD8000-memory.dmp

      Filesize

      1.0MB

    • memory/1760-9-0x0000000074AA0000-0x0000000075250000-memory.dmp

      Filesize

      7.7MB

    • memory/1760-11-0x0000000004EB0000-0x0000000004F42000-memory.dmp

      Filesize

      584KB

    • memory/1760-12-0x000000000A490000-0x000000000A4B2000-memory.dmp

      Filesize

      136KB

    • memory/1760-17-0x0000000074AA0000-0x0000000075250000-memory.dmp

      Filesize

      7.7MB

    • memory/4352-16-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4352-13-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4352-18-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4352-19-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB