Analysis

  • max time kernel
    137s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20-02-2024 06:01

General

  • Target

    d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe

  • Size

    579KB

  • MD5

    3abd65d34fbbd87ce50eaa1b0eb439d0

  • SHA1

    ff225553cca948f35a0765f48b5b146f43bb4203

  • SHA256

    d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e

  • SHA512

    3ce3c7fc6f0ae3706458e8079e50ad1e1d7235394528e001a107c5fa577badc9116f99639a3ff21fa169f941c56ba7df2b960ab0678c51b71cb6a5ae9070e616

  • SSDEEP

    12288:VZSmPwRYnOELz89xPQdPmcOYe5bGs88GqUoJBqmafhkL7OO7BU:VZSmP0Y74qdPmN5bGs88GeBfPFU

Malware Config

Extracted

Family

warzonerat

C2

sgh2024.ddns.net:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 11 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 11 IoCs
  • Detects executables embedding command execution via IExecuteCommand COM object 11 IoCs
  • Warzone RAT payload 11 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe
    "C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe
      "C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe"
      2⤵
        PID:2820
      • C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe
        "C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe"
        2⤵
          PID:2812
        • C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe
          "C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe"
          2⤵
            PID:2088
          • C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe
            "C:\Users\Admin\AppData\Local\Temp\d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e.exe"
            2⤵
            • Loads dropped DLL
            • Adds Run key to start application
            • Suspicious use of WriteProcessMemory
            PID:2780
            • C:\Users\Admin\Documents\IntelDrivers.exe
              "C:\Users\Admin\Documents\IntelDrivers.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              • Suspicious use of WriteProcessMemory
              PID:2148
              • C:\Users\Admin\Documents\IntelDrivers.exe
                "C:\Users\Admin\Documents\IntelDrivers.exe"
                4⤵
                • Executes dropped EXE
                PID:1568

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\Documents\IntelDrivers.exe

          Filesize

          579KB

          MD5

          3abd65d34fbbd87ce50eaa1b0eb439d0

          SHA1

          ff225553cca948f35a0765f48b5b146f43bb4203

          SHA256

          d10c74984d4c4dab2f492ab8b31013e552108e14c202b4cabe150ca230230b1e

          SHA512

          3ce3c7fc6f0ae3706458e8079e50ad1e1d7235394528e001a107c5fa577badc9116f99639a3ff21fa169f941c56ba7df2b960ab0678c51b71cb6a5ae9070e616

        • memory/1568-49-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1568-57-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/1568-56-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/1568-54-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/1684-3-0x00000000006D0000-0x00000000006EC000-memory.dmp

          Filesize

          112KB

        • memory/1684-1-0x0000000074C80000-0x000000007536E000-memory.dmp

          Filesize

          6.9MB

        • memory/1684-7-0x0000000004810000-0x0000000004850000-memory.dmp

          Filesize

          256KB

        • memory/1684-5-0x0000000004890000-0x00000000048F8000-memory.dmp

          Filesize

          416KB

        • memory/1684-24-0x0000000074C80000-0x000000007536E000-memory.dmp

          Filesize

          6.9MB

        • memory/1684-2-0x0000000004810000-0x0000000004850000-memory.dmp

          Filesize

          256KB

        • memory/1684-4-0x0000000001F00000-0x0000000001F12000-memory.dmp

          Filesize

          72KB

        • memory/1684-6-0x0000000074C80000-0x000000007536E000-memory.dmp

          Filesize

          6.9MB

        • memory/1684-0-0x0000000000350000-0x00000000003E8000-memory.dmp

          Filesize

          608KB

        • memory/2148-39-0x0000000074AE0000-0x00000000751CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2148-38-0x0000000000C10000-0x0000000000C50000-memory.dmp

          Filesize

          256KB

        • memory/2148-36-0x0000000000EA0000-0x0000000000F38000-memory.dmp

          Filesize

          608KB

        • memory/2148-37-0x0000000074AE0000-0x00000000751CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2148-55-0x0000000074AE0000-0x00000000751CE000-memory.dmp

          Filesize

          6.9MB

        • memory/2780-12-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-25-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-35-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-23-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-21-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-8-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-16-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/2780-18-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-17-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-14-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB

        • memory/2780-10-0x0000000000400000-0x000000000055A000-memory.dmp

          Filesize

          1.4MB