Analysis

  • max time kernel
    140s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    15-02-2024 18:15

General

  • Target

    9e3ab2e7f5e0800dcd95225fd81209e4.exe

  • Size

    1.2MB

  • MD5

    9e3ab2e7f5e0800dcd95225fd81209e4

  • SHA1

    c7caae28067a798e4f592ec157b5f779aae87344

  • SHA256

    a9164bf7d30f6de9782008453c71e87856e4bbf3e7ef8867e48f2121cd6a74f0

  • SHA512

    07516d474e51194e05aca5f07037d388c55ce02c94f13a48d691ba43d3629ae28f90e08524db01e994020140f5539d52b333afb6c10b3e5d4c2349f2c2bb9d22

  • SSDEEP

    24576:dHS/d3NKzkssksbxtn13SAdEVAdw/vdFy8jh8N6ZN9Z:IK0t1N2w0lFON6ZN9

Malware Config

Extracted

Family

warzonerat

C2

warzonlogs.duckdns.org:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • CustAttr .NET packer 2 IoCs

    Detects CustAttr .NET packer in memory.

  • Warzone RAT payload 11 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e3ab2e7f5e0800dcd95225fd81209e4.exe
    "C:\Users\Admin\AppData\Local\Temp\9e3ab2e7f5e0800dcd95225fd81209e4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2332
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PuxfpXXblaf" /XML "C:\Users\Admin\AppData\Local\Temp\tmp30.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2640
    • C:\Users\Admin\AppData\Local\Temp\9e3ab2e7f5e0800dcd95225fd81209e4.exe
      "C:\Users\Admin\AppData\Local\Temp\9e3ab2e7f5e0800dcd95225fd81209e4.exe"
      2⤵
        PID:2980
      • C:\Users\Admin\AppData\Local\Temp\9e3ab2e7f5e0800dcd95225fd81209e4.exe
        "C:\Users\Admin\AppData\Local\Temp\9e3ab2e7f5e0800dcd95225fd81209e4.exe"
        2⤵
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1100
        • C:\ProgramData\images.exe
          "C:\ProgramData\images.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2012
          • C:\Windows\SysWOW64\schtasks.exe
            "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PuxfpXXblaf" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCD5D.tmp"
            4⤵
            • Creates scheduled task(s)
            PID:1512
          • C:\ProgramData\images.exe
            "C:\ProgramData\images.exe"
            4⤵
            • Executes dropped EXE
            PID:2996
          • C:\ProgramData\images.exe
            "C:\ProgramData\images.exe"
            4⤵
            • Executes dropped EXE
            PID:1564

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp30.tmp

      Filesize

      1KB

      MD5

      ba2fc347d304952c8de42235a12fc4dd

      SHA1

      dc248085990ecfcef33ebd41a918e4e91ca4a6b6

      SHA256

      f7995844c542bf647801a37cb2d662d11b222ca8cded7fe8a20664f031521cec

      SHA512

      78fc81c7f87193e7a93b2bea11f2d1b03be51e7aaf8ebab77ffadf611fef3d7dc507f40f010dbc0077f8ed6682e8d8282211430dca30070c1337c9a462d84fd9

    • \ProgramData\images.exe

      Filesize

      1.2MB

      MD5

      9e3ab2e7f5e0800dcd95225fd81209e4

      SHA1

      c7caae28067a798e4f592ec157b5f779aae87344

      SHA256

      a9164bf7d30f6de9782008453c71e87856e4bbf3e7ef8867e48f2121cd6a74f0

      SHA512

      07516d474e51194e05aca5f07037d388c55ce02c94f13a48d691ba43d3629ae28f90e08524db01e994020140f5539d52b333afb6c10b3e5d4c2349f2c2bb9d22

    • memory/1100-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/1100-40-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-29-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-33-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-25-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-23-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-31-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-13-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-15-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-17-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-19-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1100-21-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1564-70-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1564-69-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1564-67-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1564-62-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2012-68-0x0000000073390000-0x0000000073A7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2012-46-0x0000000004E60000-0x0000000004EA0000-memory.dmp

      Filesize

      256KB

    • memory/2012-41-0x0000000000230000-0x0000000000360000-memory.dmp

      Filesize

      1.2MB

    • memory/2012-43-0x0000000004E60000-0x0000000004EA0000-memory.dmp

      Filesize

      256KB

    • memory/2012-42-0x0000000073390000-0x0000000073A7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2012-45-0x0000000073390000-0x0000000073A7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2012-44-0x0000000000510000-0x0000000000522000-memory.dmp

      Filesize

      72KB

    • memory/2332-2-0x0000000004310000-0x0000000004350000-memory.dmp

      Filesize

      256KB

    • memory/2332-7-0x00000000005D0000-0x00000000005F2000-memory.dmp

      Filesize

      136KB

    • memory/2332-6-0x00000000049A0000-0x0000000004A2C000-memory.dmp

      Filesize

      560KB

    • memory/2332-32-0x0000000074690000-0x0000000074D7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2332-3-0x0000000000390000-0x00000000003A2000-memory.dmp

      Filesize

      72KB

    • memory/2332-0-0x00000000009D0000-0x0000000000B00000-memory.dmp

      Filesize

      1.2MB

    • memory/2332-4-0x0000000074690000-0x0000000074D7E000-memory.dmp

      Filesize

      6.9MB

    • memory/2332-5-0x0000000004310000-0x0000000004350000-memory.dmp

      Filesize

      256KB

    • memory/2332-1-0x0000000074690000-0x0000000074D7E000-memory.dmp

      Filesize

      6.9MB