Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-02-2024 04:44

General

  • Target

    b629c386aad3d232fcab9767273721b1a31277cf7ff2397d1b6b5cc8920cc68a.xll

  • Size

    979KB

  • MD5

    33d33e32134191de2d7a75b3e9c4b289

  • SHA1

    a66979de85535a31eb6a0c199f8598a4581291f2

  • SHA256

    b629c386aad3d232fcab9767273721b1a31277cf7ff2397d1b6b5cc8920cc68a

  • SHA512

    0fe41ed5e82f94d3eea9fcd22137196cc22a3e11bdd8e9591c6ef7c901ea200c961f55a8e551ad776d6b9b60bf7a5367956efee95ed361c8c79b05f6602e5e92

  • SSDEEP

    24576:3oOOMX1f+QHT+dAodK0h8jzTv6JDs2cfp2G:3oOOm+QHsf8jzTv6ksG

Malware Config

Extracted

Language
xlm4.0
Source

Extracted

Family

warzonerat

C2

satgobleien.jumpingcrab.com:5208

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 9 IoCs
  • Detects executables embedding command execution via IExecuteCommand COM object 9 IoCs
  • Detects executables packed with ConfuserEx Mod 5 IoCs
  • Warzone RAT payload 9 IoCs
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\b629c386aad3d232fcab9767273721b1a31277cf7ff2397d1b6b5cc8920cc68a.xll"
    1⤵
    • Loads dropped DLL
    • Checks processor information in registry
    • Enumerates system info in registry
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4832
    • C:\Users\Admin\AppData\Local\Temp\483eb5d4-c0a5-4e97-b3cf-d2d2f65f0a19.exe
      "C:\Users\Admin\AppData\Local\Temp\483eb5d4-c0a5-4e97-b3cf-d2d2f65f0a19.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4328
      • C:\Users\Admin\AppData\Local\Temp\483eb5d4-c0a5-4e97-b3cf-d2d2f65f0a19.exe
        C:\Users\Admin\AppData\Local\Temp\483eb5d4-c0a5-4e97-b3cf-d2d2f65f0a19.exe
        3⤵
        • Executes dropped EXE
        PID:2844
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2844 -s 80
          4⤵
          • Program crash
          PID:2392
      • C:\Users\Admin\AppData\Local\Temp\483eb5d4-c0a5-4e97-b3cf-d2d2f65f0a19.exe
        C:\Users\Admin\AppData\Local\Temp\483eb5d4-c0a5-4e97-b3cf-d2d2f65f0a19.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:4448
        • C:\ProgramData\rimages.exe
          "C:\ProgramData\rimages.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3880
          • C:\ProgramData\rimages.exe
            C:\ProgramData\rimages.exe
            5⤵
            • Executes dropped EXE
            PID:668
          • C:\ProgramData\rimages.exe
            C:\ProgramData\rimages.exe
            5⤵
            • Executes dropped EXE
            PID:5044
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2844 -ip 2844
    1⤵
      PID:4632

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\483eb5d4-c0a5-4e97-b3cf-d2d2f65f0a19.exe

      Filesize

      383KB

      MD5

      b473264c556546f6adf84b8af73b90a2

      SHA1

      20936e113bcac50382fc4f2770acec2b027a48cc

      SHA256

      ef1703000daf0e15e2476b6b7df6b04afdfe16b6bf935625161e6ed8bcc937f5

      SHA512

      13848d52ee286a026803afdbbc124f6bb03c04bd8b77540a35dc6df13516730c162ccc61b5c936081f3449a30bbb594a90ba15abd2f750ee1d030271a815b90a

    • C:\Users\Admin\AppData\Local\Temp\b629c386aad3d232fcab9767273721b1a31277cf7ff2397d1b6b5cc8920cc68a.xll

      Filesize

      979KB

      MD5

      33d33e32134191de2d7a75b3e9c4b289

      SHA1

      a66979de85535a31eb6a0c199f8598a4581291f2

      SHA256

      b629c386aad3d232fcab9767273721b1a31277cf7ff2397d1b6b5cc8920cc68a

      SHA512

      0fe41ed5e82f94d3eea9fcd22137196cc22a3e11bdd8e9591c6ef7c901ea200c961f55a8e551ad776d6b9b60bf7a5367956efee95ed361c8c79b05f6602e5e92

    • memory/668-107-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/668-98-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/668-93-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3880-103-0x0000000073FF0000-0x00000000747A0000-memory.dmp

      Filesize

      7.7MB

    • memory/3880-86-0x0000000004BC0000-0x0000000004BD0000-memory.dmp

      Filesize

      64KB

    • memory/3880-83-0x0000000073FF0000-0x00000000747A0000-memory.dmp

      Filesize

      7.7MB

    • memory/4328-56-0x0000000004A50000-0x0000000004A56000-memory.dmp

      Filesize

      24KB

    • memory/4328-60-0x000000000DDB0000-0x000000000E354000-memory.dmp

      Filesize

      5.6MB

    • memory/4328-58-0x000000000D650000-0x000000000D6BA000-memory.dmp

      Filesize

      424KB

    • memory/4328-59-0x000000000D760000-0x000000000D7FC000-memory.dmp

      Filesize

      624KB

    • memory/4328-54-0x00000000000C0000-0x0000000000128000-memory.dmp

      Filesize

      416KB

    • memory/4328-55-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4328-70-0x0000000074B30000-0x00000000752E0000-memory.dmp

      Filesize

      7.7MB

    • memory/4328-57-0x0000000004A80000-0x0000000004A90000-memory.dmp

      Filesize

      64KB

    • memory/4328-61-0x000000000D8A0000-0x000000000D932000-memory.dmp

      Filesize

      584KB

    • memory/4328-62-0x00000000045B0000-0x00000000045B6000-memory.dmp

      Filesize

      24KB

    • memory/4448-82-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4448-65-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4448-69-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4448-71-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4832-124-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-75-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-30-0x0000022C08D30000-0x0000022C08D6C000-memory.dmp

      Filesize

      240KB

    • memory/4832-31-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-29-0x00007FFF70B90000-0x00007FFF71651000-memory.dmp

      Filesize

      10.8MB

    • memory/4832-32-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-33-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-37-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-39-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-38-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-40-0x0000022C08DC0000-0x0000022C08E2A000-memory.dmp

      Filesize

      424KB

    • memory/4832-7-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-27-0x0000022C08BD0000-0x0000022C08BE4000-memory.dmp

      Filesize

      80KB

    • memory/4832-26-0x0000022C08BD0000-0x0000022C08BE4000-memory.dmp

      Filesize

      80KB

    • memory/4832-0-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-8-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-125-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-9-0x00007FFF56140000-0x00007FFF56150000-memory.dmp

      Filesize

      64KB

    • memory/4832-19-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-22-0x0000022C062F0000-0x0000022C063FD000-memory.dmp

      Filesize

      1.1MB

    • memory/4832-18-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-16-0x00007FFF56140000-0x00007FFF56150000-memory.dmp

      Filesize

      64KB

    • memory/4832-15-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-14-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-13-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-28-0x0000022C21F50000-0x0000022C220D4000-memory.dmp

      Filesize

      1.5MB

    • memory/4832-76-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-77-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-12-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-5-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-84-0x00007FFF70B90000-0x00007FFF71651000-memory.dmp

      Filesize

      10.8MB

    • memory/4832-85-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-6-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-3-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-95-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-97-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-96-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-4-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-127-0x00007FFF70B90000-0x00007FFF71651000-memory.dmp

      Filesize

      10.8MB

    • memory/4832-99-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-101-0x0000022C08EF0000-0x0000022C08F00000-memory.dmp

      Filesize

      64KB

    • memory/4832-126-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-2-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-1-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-122-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-11-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/4832-123-0x00007FFF58A70000-0x00007FFF58A80000-memory.dmp

      Filesize

      64KB

    • memory/4832-10-0x00007FFF989F0000-0x00007FFF98BE5000-memory.dmp

      Filesize

      2.0MB

    • memory/5044-104-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/5044-100-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB