Analysis

  • max time kernel
    126s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2024 04:39

General

  • Target

    9ac604ab0f70a0d75f107b8f52d97000.exe

  • Size

    1.4MB

  • MD5

    9ac604ab0f70a0d75f107b8f52d97000

  • SHA1

    48bfbec3b38f5070419e63efce548e7a234a3f0c

  • SHA256

    46dff1fda981f377a8ae116f14a7a4352e373787186606d2c5a91ae0c6c25609

  • SHA512

    5abea1a5274fd72fc64a44f3aea3545e4b5ab3e2d261c399ff40495f42fc59089756f832f1f0fa408e8714f76a710d2d616017193b53ba074172498e722bcd73

  • SSDEEP

    24576:V/CqsL1yQdGc9O42AT2fXB52MMMMMMMMMMMuMMMMMMMMMMMMMMMMMMMMMMMMMMMX:icAGc9O42AT2/KMMMMMMMMMMMuMMMMML

Malware Config

Extracted

Family

warzonerat

C2

185.222.57.73:4557

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9ac604ab0f70a0d75f107b8f52d97000.exe
    "C:\Users\Admin\AppData\Local\Temp\9ac604ab0f70a0d75f107b8f52d97000.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:368
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oUZjHsjH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF55C.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:4372
    • C:\Users\Admin\AppData\Local\Temp\9ac604ab0f70a0d75f107b8f52d97000.exe
      "C:\Users\Admin\AppData\Local\Temp\9ac604ab0f70a0d75f107b8f52d97000.exe"
      2⤵
        PID:3728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpF55C.tmp

      Filesize

      1KB

      MD5

      51b8e5ba2921294201821908afb13d9c

      SHA1

      f8e3be854ac33a7877cf9997c8126f295dedc7da

      SHA256

      8934577514c6870ec3d301fd69c20157efaf554296274e2f2c96252c4922d383

      SHA512

      89cb9a316e866084ee8cc72fa10328b9aa4a07b32b37b78c44464424c1d5c251c0bccf8d7baa3f12a1497c37111178c40c021b5c3312581b453cf31fe4077a16

    • memory/368-8-0x0000000005C10000-0x0000000005C2E000-memory.dmp

      Filesize

      120KB

    • memory/368-3-0x0000000006220000-0x00000000067C4000-memory.dmp

      Filesize

      5.6MB

    • memory/368-10-0x0000000005E90000-0x0000000005EA0000-memory.dmp

      Filesize

      64KB

    • memory/368-11-0x0000000006BD0000-0x0000000006C60000-memory.dmp

      Filesize

      576KB

    • memory/368-5-0x0000000005E90000-0x0000000005EA0000-memory.dmp

      Filesize

      64KB

    • memory/368-6-0x0000000005BD0000-0x0000000005BDA000-memory.dmp

      Filesize

      40KB

    • memory/368-7-0x0000000005D10000-0x0000000005D66000-memory.dmp

      Filesize

      344KB

    • memory/368-0-0x0000000000FE0000-0x0000000001144000-memory.dmp

      Filesize

      1.4MB

    • memory/368-9-0x0000000074640000-0x0000000074DF0000-memory.dmp

      Filesize

      7.7MB

    • memory/368-2-0x0000000005B20000-0x0000000005BBC000-memory.dmp

      Filesize

      624KB

    • memory/368-4-0x0000000005C70000-0x0000000005D02000-memory.dmp

      Filesize

      584KB

    • memory/368-12-0x00000000068A0000-0x00000000068C2000-memory.dmp

      Filesize

      136KB

    • memory/368-1-0x0000000074640000-0x0000000074DF0000-memory.dmp

      Filesize

      7.7MB

    • memory/368-23-0x0000000074640000-0x0000000074DF0000-memory.dmp

      Filesize

      7.7MB

    • memory/3728-21-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3728-18-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3728-22-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3728-24-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB