Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-02-2024 15:35

General

  • Target

    9c0a708ac219fdf26a8df99f338ba1da.exe

  • Size

    507KB

  • MD5

    9c0a708ac219fdf26a8df99f338ba1da

  • SHA1

    a84dbb0ee9c53b9e2dceca4a37a88dbdbdeb2c20

  • SHA256

    7aefa586d32593736751d667d9588fcf4c3091ace48375d38f06947aa119129e

  • SHA512

    e76bde008c2464d0c917c3ec4b3490f8fb0c6ee09f4210ac0852a4c99e9db92c1383e9d74d383d719daa16e540598ef274d9084c9ee34bd2cec9353ba7966109

  • SSDEEP

    12288:CZZsq/S5WTYPnd8lzM452uiwKDeI5S9AV83CXlco9FzwHJe:m8SCKBciICAu3CX+o95wpe

Malware Config

Extracted

Family

warzonerat

C2

tobi12345.hopto.org:50501

Signatures

  • Detect ZGRat V1 34 IoCs
  • Detects BazaLoader malware 4 IoCs

    BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • ZGRat

    ZGRat is remote access trojan written in C#.

  • Warzone RAT payload 4 IoCs
  • Drops startup file 2 IoCs
  • Executes dropped EXE 7 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9c0a708ac219fdf26a8df99f338ba1da.exe
    "C:\Users\Admin\AppData\Local\Temp\9c0a708ac219fdf26a8df99f338ba1da.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:392
    • C:\Users\Admin\AppData\Local\Temp\9c0a708ac219fdf26a8df99f338ba1da.exe
      C:\Users\Admin\AppData\Local\Temp\9c0a708ac219fdf26a8df99f338ba1da.exe
      2⤵
        PID:4492
      • C:\Users\Admin\AppData\Local\Temp\9c0a708ac219fdf26a8df99f338ba1da.exe
        C:\Users\Admin\AppData\Local\Temp\9c0a708ac219fdf26a8df99f338ba1da.exe
        2⤵
        • Drops startup file
        • NTFS ADS
        • Suspicious use of WriteProcessMemory
        PID:116
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1216
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"
            4⤵
              PID:1684
          • C:\ProgramData\win32.exe
            "C:\ProgramData\win32.exe"
            3⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4484
            • C:\Users\Admin\AppData\Local\Temp\win32.exe
              C:\Users\Admin\AppData\Local\Temp\win32.exe
              4⤵
              • Executes dropped EXE
              PID:1908
            • C:\Users\Admin\AppData\Local\Temp\win32.exe
              C:\Users\Admin\AppData\Local\Temp\win32.exe
              4⤵
              • Executes dropped EXE
              PID:5092
            • C:\Users\Admin\AppData\Local\Temp\win32.exe
              C:\Users\Admin\AppData\Local\Temp\win32.exe
              4⤵
              • Executes dropped EXE
              PID:3216
            • C:\Users\Admin\AppData\Local\Temp\win32.exe
              C:\Users\Admin\AppData\Local\Temp\win32.exe
              4⤵
              • Executes dropped EXE
              PID:3992
            • C:\Users\Admin\AppData\Local\Temp\win32.exe
              C:\Users\Admin\AppData\Local\Temp\win32.exe
              4⤵
              • Executes dropped EXE
              PID:3964
            • C:\Users\Admin\AppData\Local\Temp\win32.exe
              C:\Users\Admin\AppData\Local\Temp\win32.exe
              4⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:668
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe"
                5⤵
                  PID:2624

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\win32.exe

          Filesize

          507KB

          MD5

          9c0a708ac219fdf26a8df99f338ba1da

          SHA1

          a84dbb0ee9c53b9e2dceca4a37a88dbdbdeb2c20

          SHA256

          7aefa586d32593736751d667d9588fcf4c3091ace48375d38f06947aa119129e

          SHA512

          e76bde008c2464d0c917c3ec4b3490f8fb0c6ee09f4210ac0852a4c99e9db92c1383e9d74d383d719daa16e540598ef274d9084c9ee34bd2cec9353ba7966109

        • memory/116-2453-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/116-2461-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/392-51-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-49-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-2-0x0000000005B00000-0x0000000005B10000-memory.dmp

          Filesize

          64KB

        • memory/392-3-0x00000000058B0000-0x00000000058B1000-memory.dmp

          Filesize

          4KB

        • memory/392-5-0x0000000005A10000-0x0000000005AA2000-memory.dmp

          Filesize

          584KB

        • memory/392-4-0x00000000060C0000-0x0000000006664000-memory.dmp

          Filesize

          5.6MB

        • memory/392-6-0x00000000059E0000-0x00000000059EA000-memory.dmp

          Filesize

          40KB

        • memory/392-7-0x0000000075330000-0x0000000075AE0000-memory.dmp

          Filesize

          7.7MB

        • memory/392-8-0x0000000007650000-0x00000000076A8000-memory.dmp

          Filesize

          352KB

        • memory/392-9-0x00000000076B0000-0x0000000007708000-memory.dmp

          Filesize

          352KB

        • memory/392-10-0x0000000007790000-0x0000000007806000-memory.dmp

          Filesize

          472KB

        • memory/392-11-0x0000000007930000-0x00000000079A6000-memory.dmp

          Filesize

          472KB

        • memory/392-12-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-13-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-15-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-17-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-19-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-21-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-23-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-25-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-33-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-31-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-71-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-29-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-0-0x0000000000F30000-0x0000000000FB4000-memory.dmp

          Filesize

          528KB

        • memory/392-61-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-35-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-75-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-1-0x0000000075330000-0x0000000075AE0000-memory.dmp

          Filesize

          7.7MB

        • memory/392-69-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-67-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-65-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-63-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-59-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-57-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-55-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-53-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-73-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-47-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-45-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-43-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-41-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-39-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-37-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-27-0x0000000007930000-0x00000000079A0000-memory.dmp

          Filesize

          448KB

        • memory/392-2446-0x0000000007A10000-0x0000000007A2E000-memory.dmp

          Filesize

          120KB

        • memory/392-2452-0x0000000075330000-0x0000000075AE0000-memory.dmp

          Filesize

          7.7MB

        • memory/668-4922-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/668-4926-0x0000000000400000-0x000000000055E000-memory.dmp

          Filesize

          1.4MB

        • memory/4484-2463-0x0000000074B90000-0x0000000075340000-memory.dmp

          Filesize

          7.7MB

        • memory/4484-2464-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4484-2465-0x0000000000E00000-0x0000000000E01000-memory.dmp

          Filesize

          4KB

        • memory/4484-2466-0x0000000074B90000-0x0000000075340000-memory.dmp

          Filesize

          7.7MB

        • memory/4484-2467-0x0000000004E30000-0x0000000004E40000-memory.dmp

          Filesize

          64KB

        • memory/4484-4921-0x0000000074B90000-0x0000000075340000-memory.dmp

          Filesize

          7.7MB