Analysis

  • max time kernel
    145s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2024 01:01

General

  • Target

    bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a.exe

  • Size

    870KB

  • MD5

    0c74bc9529b8d9f96fc7e1b47559abd1

  • SHA1

    232bb8f072131d66e317b1f8acb1371e999447cb

  • SHA256

    bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a

  • SHA512

    0ceb0b9eb1923c748b5d30281a023a0fcb407f68e8e9b3d63b289ea96770215ebd7801bd5744beba234319bef2494bfc211b1cab5bd9ac65a34fa36a6f9d54eb

  • SSDEEP

    24576:B44dBZcMzXROOhbXxHZCnkgDAN1jtyhfz87brh8:zdBZNzXROUtHZKu1+fz87h

Malware Config

Extracted

Family

warzonerat

C2

makatti.duckdns.org:3787

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a.exe
    "C:\Users\Admin\AppData\Local\Temp\bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4752
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IDXJRvJUpAIjP.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1188
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IDXJRvJUpAIjP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp754F.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3268
    • C:\Users\Admin\AppData\Local\Temp\bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a.exe
      "C:\Users\Admin\AppData\Local\Temp\bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a.exe"
      2⤵
        PID:1700
      • C:\Users\Admin\AppData\Local\Temp\bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a.exe
        "C:\Users\Admin\AppData\Local\Temp\bc7a00a440550e0b93368e5d1524e9b5a46177f26518803d85268d9d7a1cca8a.exe"
        2⤵
          PID:2396

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1iknd2hd.cvv.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Local\Temp\tmp754F.tmp

        Filesize

        1KB

        MD5

        6c8df7c5c3859eb7b86633b1e72c03ff

        SHA1

        4a2440159fbd1b7cb2de9cecc21f6b1567ce5eaf

        SHA256

        05a0b5712473edd26e530cb7936561352b67310c54cd0c4cc2e67450c160573b

        SHA512

        b4ae832efe1dfe14a81ecd1226cdc5d36521cc8fcb3c8f4ae9028763b4a5b44349021cc388eaee2afd0148b200982557c589c9c37634c9e4af1cd69272cd8807

      • memory/1188-56-0x0000000007230000-0x00000000072D3000-memory.dmp

        Filesize

        652KB

      • memory/1188-38-0x0000000005EF0000-0x0000000006244000-memory.dmp

        Filesize

        3.3MB

      • memory/1188-55-0x00000000067E0000-0x00000000067FE000-memory.dmp

        Filesize

        120KB

      • memory/1188-54-0x00000000029C0000-0x00000000029D0000-memory.dmp

        Filesize

        64KB

      • memory/1188-65-0x0000000007890000-0x0000000007898000-memory.dmp

        Filesize

        32KB

      • memory/1188-64-0x00000000078B0000-0x00000000078CA000-memory.dmp

        Filesize

        104KB

      • memory/1188-63-0x00000000077B0000-0x00000000077C4000-memory.dmp

        Filesize

        80KB

      • memory/1188-62-0x00000000077A0000-0x00000000077AE000-memory.dmp

        Filesize

        56KB

      • memory/1188-61-0x0000000007770000-0x0000000007781000-memory.dmp

        Filesize

        68KB

      • memory/1188-15-0x0000000002940000-0x0000000002976000-memory.dmp

        Filesize

        216KB

      • memory/1188-16-0x0000000074FE0000-0x0000000075790000-memory.dmp

        Filesize

        7.7MB

      • memory/1188-18-0x00000000053C0000-0x00000000059E8000-memory.dmp

        Filesize

        6.2MB

      • memory/1188-17-0x00000000029C0000-0x00000000029D0000-memory.dmp

        Filesize

        64KB

      • memory/1188-19-0x00000000029C0000-0x00000000029D0000-memory.dmp

        Filesize

        64KB

      • memory/1188-60-0x00000000077F0000-0x0000000007886000-memory.dmp

        Filesize

        600KB

      • memory/1188-57-0x0000000007BB0000-0x000000000822A000-memory.dmp

        Filesize

        6.5MB

      • memory/1188-44-0x0000000075870000-0x00000000758BC000-memory.dmp

        Filesize

        304KB

      • memory/1188-59-0x00000000075E0000-0x00000000075EA000-memory.dmp

        Filesize

        40KB

      • memory/1188-29-0x0000000005B60000-0x0000000005BC6000-memory.dmp

        Filesize

        408KB

      • memory/1188-43-0x00000000071F0000-0x0000000007222000-memory.dmp

        Filesize

        200KB

      • memory/1188-68-0x0000000074FE0000-0x0000000075790000-memory.dmp

        Filesize

        7.7MB

      • memory/1188-58-0x0000000007570000-0x000000000758A000-memory.dmp

        Filesize

        104KB

      • memory/1188-21-0x0000000005A30000-0x0000000005A52000-memory.dmp

        Filesize

        136KB

      • memory/1188-35-0x0000000005E80000-0x0000000005EE6000-memory.dmp

        Filesize

        408KB

      • memory/1188-40-0x0000000005E60000-0x0000000005E7E000-memory.dmp

        Filesize

        120KB

      • memory/1188-41-0x0000000006280000-0x00000000062CC000-memory.dmp

        Filesize

        304KB

      • memory/1188-42-0x000000007FCC0000-0x000000007FCD0000-memory.dmp

        Filesize

        64KB

      • memory/2396-30-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2396-22-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2396-37-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/2396-69-0x0000000000400000-0x000000000041D000-memory.dmp

        Filesize

        116KB

      • memory/4752-5-0x0000000004D10000-0x0000000004D1A000-memory.dmp

        Filesize

        40KB

      • memory/4752-1-0x0000000074FE0000-0x0000000075790000-memory.dmp

        Filesize

        7.7MB

      • memory/4752-3-0x0000000004B50000-0x0000000004BE2000-memory.dmp

        Filesize

        584KB

      • memory/4752-0-0x0000000000090000-0x0000000000170000-memory.dmp

        Filesize

        896KB

      • memory/4752-2-0x0000000005060000-0x0000000005604000-memory.dmp

        Filesize

        5.6MB

      • memory/4752-10-0x000000000A0F0000-0x000000000A18C000-memory.dmp

        Filesize

        624KB

      • memory/4752-9-0x00000000078A0000-0x0000000007906000-memory.dmp

        Filesize

        408KB

      • memory/4752-8-0x0000000007890000-0x000000000789E000-memory.dmp

        Filesize

        56KB

      • memory/4752-7-0x0000000007880000-0x000000000788A000-memory.dmp

        Filesize

        40KB

      • memory/4752-6-0x0000000007850000-0x0000000007864000-memory.dmp

        Filesize

        80KB

      • memory/4752-39-0x0000000074FE0000-0x0000000075790000-memory.dmp

        Filesize

        7.7MB

      • memory/4752-4-0x0000000004D90000-0x0000000004DA0000-memory.dmp

        Filesize

        64KB