Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2024 10:04

General

  • Target

    9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll

  • Size

    1.0MB

  • MD5

    08fea09ff0b64eeed38c5e5056626b86

  • SHA1

    5bed42391c7c2c2bfd853a51b5f38b87e0ee03ed

  • SHA256

    9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009

  • SHA512

    630fd25bc6dda06257069dfdee0488f03fa0bceb1c2f4425d65983ca21f42a1b5b5ac67e8f6468d46ea39c58d1f4033762ce3e18e118a11c81e54d8dd0f39066

  • SSDEEP

    24576:qoOOMX1p+QHT+ddtvGIs6oa/UTpmdjH23NY/q:qoOOw+QHsPv9oaw6SdYS

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

warzonerat

C2

qoldwold.zanity.net:5208

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 9 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1464
    • C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
      "C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3116
      • C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
        C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
        3⤵
        • Executes dropped EXE
        PID:1500
      • C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
        C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4388
        • C:\ProgramData\cmages.exe
          "C:\ProgramData\cmages.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3756
          • C:\ProgramData\cmages.exe
            C:\ProgramData\cmages.exe
            5⤵
            • Executes dropped EXE
            PID:4680
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 80
              6⤵
              • Program crash
              PID:776
          • C:\ProgramData\cmages.exe
            C:\ProgramData\cmages.exe
            5⤵
            • Executes dropped EXE
            PID:3524
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4680 -ip 4680
    1⤵
      PID:1428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\0537a932-4d88-4664-8b92-dc52364ce737.exe

      Filesize

      486KB

      MD5

      c4c2b1de0beed142e649ed9db54135d8

      SHA1

      3c290091b7ef5b8e3a9f5f1d7b5a091845c5cbf3

      SHA256

      bf81759f58a1c186019e567df6ef5347d61ec3d032be37c6a9268a59c5679a88

      SHA512

      f806647de157e68cc6f47008eb8661aa238fba136eea475183fab03339e566c8c47cd36a2539626cd978ff1b0e8926fa6242a369f44ed7d68ce3989ee12949cc

    • C:\Users\Admin\AppData\Local\Temp\9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009.xll

      Filesize

      1.0MB

      MD5

      08fea09ff0b64eeed38c5e5056626b86

      SHA1

      5bed42391c7c2c2bfd853a51b5f38b87e0ee03ed

      SHA256

      9b631808752d97a24c25c81b99a8739ff79b3a5689aeb4e5e9a9068d155e8009

      SHA512

      630fd25bc6dda06257069dfdee0488f03fa0bceb1c2f4425d65983ca21f42a1b5b5ac67e8f6468d46ea39c58d1f4033762ce3e18e118a11c81e54d8dd0f39066

    • memory/1464-29-0x000001FD6A2D0000-0x000001FD6A454000-memory.dmp

      Filesize

      1.5MB

    • memory/1464-5-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-3-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-32-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-31-0x00007FFC30A90000-0x00007FFC31551000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-7-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-8-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-9-0x00007FFC16720000-0x00007FFC16730000-memory.dmp

      Filesize

      64KB

    • memory/1464-10-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-11-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-12-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-13-0x00007FFC16720000-0x00007FFC16730000-memory.dmp

      Filesize

      64KB

    • memory/1464-14-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-15-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-16-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-17-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-19-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-18-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-20-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-21-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-22-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-25-0x000001FD508B0000-0x000001FD509D2000-memory.dmp

      Filesize

      1.1MB

    • memory/1464-2-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-28-0x000001FD51F10000-0x000001FD51F24000-memory.dmp

      Filesize

      80KB

    • memory/1464-100-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-4-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-6-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-30-0x000001FD52010000-0x000001FD5204C000-memory.dmp

      Filesize

      240KB

    • memory/1464-33-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-34-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-37-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-38-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-39-0x000001FD6A450000-0x000001FD6A4D4000-memory.dmp

      Filesize

      528KB

    • memory/1464-1-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-0-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-127-0x00007FFC30A90000-0x00007FFC31551000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-126-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-125-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-124-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-123-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-122-0x00007FFC18DB0000-0x00007FFC18DC0000-memory.dmp

      Filesize

      64KB

    • memory/1464-106-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-105-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-95-0x00007FFC30A90000-0x00007FFC31551000-memory.dmp

      Filesize

      10.8MB

    • memory/1464-99-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-93-0x00007FFC58D30000-0x00007FFC58F25000-memory.dmp

      Filesize

      2.0MB

    • memory/1464-102-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1464-101-0x000001FD6A250000-0x000001FD6A260000-memory.dmp

      Filesize

      64KB

    • memory/1500-77-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1500-74-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1500-71-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1500-65-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3116-57-0x0000000074980000-0x0000000075130000-memory.dmp

      Filesize

      7.7MB

    • memory/3116-61-0x0000000005250000-0x00000000052EC000-memory.dmp

      Filesize

      624KB

    • memory/3116-56-0x00000000004A0000-0x0000000000524000-memory.dmp

      Filesize

      528KB

    • memory/3116-58-0x0000000002810000-0x0000000002816000-memory.dmp

      Filesize

      24KB

    • memory/3116-59-0x0000000004EC0000-0x0000000004ED0000-memory.dmp

      Filesize

      64KB

    • memory/3116-60-0x0000000005130000-0x00000000051A8000-memory.dmp

      Filesize

      480KB

    • memory/3116-62-0x00000000058A0000-0x0000000005E44000-memory.dmp

      Filesize

      5.6MB

    • memory/3116-63-0x00000000052F0000-0x0000000005382000-memory.dmp

      Filesize

      584KB

    • memory/3116-75-0x0000000074980000-0x0000000075130000-memory.dmp

      Filesize

      7.7MB

    • memory/3116-64-0x0000000004FF0000-0x0000000004FF6000-memory.dmp

      Filesize

      24KB

    • memory/3524-107-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3524-94-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3524-91-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3756-92-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/3756-83-0x00000000742F0000-0x0000000074AA0000-memory.dmp

      Filesize

      7.7MB

    • memory/3756-84-0x0000000005540000-0x0000000005550000-memory.dmp

      Filesize

      64KB

    • memory/4388-76-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4388-81-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB