Analysis
-
max time kernel
150s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
09-04-2024 19:08
Behavioral task
behavioral1
Sample
0ddf4a2321982e95551f6e1b06e654ae.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
0ddf4a2321982e95551f6e1b06e654ae.exe
Resource
win10v2004-20240226-en
General
-
Target
0ddf4a2321982e95551f6e1b06e654ae.exe
-
Size
1.3MB
-
MD5
0ddf4a2321982e95551f6e1b06e654ae
-
SHA1
0deec7f78f1ea77c893ccfa25efcc282b3abe606
-
SHA256
a688000554d110507b10d9abf46bfe6f032399ea82c8eb1a982c59cd179f68b3
-
SHA512
ca4f0b5b1a6a26dd05dfd169ed1981dea9497207f0f7ea080c8dfa96ab3bee3699b3fe380c4c925d1260de776ec42750fce195367f039bdff5a888c32f9a611c
-
SSDEEP
24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYA:8u0c++OCvkGs9Fa+rd1f26RaYA
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Blasthost.exe netwire behavioral1/memory/2812-23-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2612-44-0x0000000000400000-0x000000000042C000-memory.dmp netwire C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe netwire behavioral1/memory/2684-85-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2612-92-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2476-28-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2476-38-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat -
Executes dropped EXE 8 IoCs
Processes:
Blasthost.exeHost.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exepid process 2812 Blasthost.exe 2612 Host.exe 2052 RtDCpl64.exe 2684 Blasthost.exe 2620 RtDCpl64.exe 612 RtDCpl64.exe 1464 Blasthost.exe 1124 RtDCpl64.exe -
Loads dropped DLL 13 IoCs
Processes:
0ddf4a2321982e95551f6e1b06e654ae.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exepid process 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 2812 Blasthost.exe 2812 Blasthost.exe 2052 RtDCpl64.exe 2052 RtDCpl64.exe 2052 RtDCpl64.exe 2052 RtDCpl64.exe 612 RtDCpl64.exe 612 RtDCpl64.exe 612 RtDCpl64.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
0ddf4a2321982e95551f6e1b06e654ae.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 2164 set thread context of 2476 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 0ddf4a2321982e95551f6e1b06e654ae.exe PID 2052 set thread context of 2620 2052 RtDCpl64.exe RtDCpl64.exe PID 612 set thread context of 1124 612 RtDCpl64.exe RtDCpl64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2740 schtasks.exe 2732 schtasks.exe 1376 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0ddf4a2321982e95551f6e1b06e654ae.exeBlasthost.exe0ddf4a2321982e95551f6e1b06e654ae.exetaskeng.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 2164 wrote to memory of 2812 2164 0ddf4a2321982e95551f6e1b06e654ae.exe Blasthost.exe PID 2164 wrote to memory of 2812 2164 0ddf4a2321982e95551f6e1b06e654ae.exe Blasthost.exe PID 2164 wrote to memory of 2812 2164 0ddf4a2321982e95551f6e1b06e654ae.exe Blasthost.exe PID 2164 wrote to memory of 2812 2164 0ddf4a2321982e95551f6e1b06e654ae.exe Blasthost.exe PID 2812 wrote to memory of 2612 2812 Blasthost.exe Host.exe PID 2812 wrote to memory of 2612 2812 Blasthost.exe Host.exe PID 2812 wrote to memory of 2612 2812 Blasthost.exe Host.exe PID 2812 wrote to memory of 2612 2812 Blasthost.exe Host.exe PID 2164 wrote to memory of 2476 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 0ddf4a2321982e95551f6e1b06e654ae.exe PID 2164 wrote to memory of 2476 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 0ddf4a2321982e95551f6e1b06e654ae.exe PID 2164 wrote to memory of 2476 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 0ddf4a2321982e95551f6e1b06e654ae.exe PID 2164 wrote to memory of 2476 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 0ddf4a2321982e95551f6e1b06e654ae.exe PID 2164 wrote to memory of 2476 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 0ddf4a2321982e95551f6e1b06e654ae.exe PID 2164 wrote to memory of 2476 2164 0ddf4a2321982e95551f6e1b06e654ae.exe 0ddf4a2321982e95551f6e1b06e654ae.exe PID 2164 wrote to memory of 2740 2164 0ddf4a2321982e95551f6e1b06e654ae.exe schtasks.exe PID 2164 wrote to memory of 2740 2164 0ddf4a2321982e95551f6e1b06e654ae.exe schtasks.exe PID 2164 wrote to memory of 2740 2164 0ddf4a2321982e95551f6e1b06e654ae.exe schtasks.exe PID 2164 wrote to memory of 2740 2164 0ddf4a2321982e95551f6e1b06e654ae.exe schtasks.exe PID 2476 wrote to memory of 2032 2476 0ddf4a2321982e95551f6e1b06e654ae.exe cmd.exe PID 2476 wrote to memory of 2032 2476 0ddf4a2321982e95551f6e1b06e654ae.exe cmd.exe PID 2476 wrote to memory of 2032 2476 0ddf4a2321982e95551f6e1b06e654ae.exe cmd.exe PID 2476 wrote to memory of 2032 2476 0ddf4a2321982e95551f6e1b06e654ae.exe cmd.exe PID 2476 wrote to memory of 2032 2476 0ddf4a2321982e95551f6e1b06e654ae.exe cmd.exe PID 2476 wrote to memory of 2032 2476 0ddf4a2321982e95551f6e1b06e654ae.exe cmd.exe PID 2952 wrote to memory of 2052 2952 taskeng.exe RtDCpl64.exe PID 2952 wrote to memory of 2052 2952 taskeng.exe RtDCpl64.exe PID 2952 wrote to memory of 2052 2952 taskeng.exe RtDCpl64.exe PID 2952 wrote to memory of 2052 2952 taskeng.exe RtDCpl64.exe PID 2052 wrote to memory of 2684 2052 RtDCpl64.exe Blasthost.exe PID 2052 wrote to memory of 2684 2052 RtDCpl64.exe Blasthost.exe PID 2052 wrote to memory of 2684 2052 RtDCpl64.exe Blasthost.exe PID 2052 wrote to memory of 2684 2052 RtDCpl64.exe Blasthost.exe PID 2052 wrote to memory of 2620 2052 RtDCpl64.exe RtDCpl64.exe PID 2052 wrote to memory of 2620 2052 RtDCpl64.exe RtDCpl64.exe PID 2052 wrote to memory of 2620 2052 RtDCpl64.exe RtDCpl64.exe PID 2052 wrote to memory of 2620 2052 RtDCpl64.exe RtDCpl64.exe PID 2052 wrote to memory of 2620 2052 RtDCpl64.exe RtDCpl64.exe PID 2052 wrote to memory of 2620 2052 RtDCpl64.exe RtDCpl64.exe PID 2620 wrote to memory of 1196 2620 RtDCpl64.exe cmd.exe PID 2620 wrote to memory of 1196 2620 RtDCpl64.exe cmd.exe PID 2620 wrote to memory of 1196 2620 RtDCpl64.exe cmd.exe PID 2620 wrote to memory of 1196 2620 RtDCpl64.exe cmd.exe PID 2052 wrote to memory of 2732 2052 RtDCpl64.exe schtasks.exe PID 2052 wrote to memory of 2732 2052 RtDCpl64.exe schtasks.exe PID 2052 wrote to memory of 2732 2052 RtDCpl64.exe schtasks.exe PID 2052 wrote to memory of 2732 2052 RtDCpl64.exe schtasks.exe PID 2620 wrote to memory of 1196 2620 RtDCpl64.exe cmd.exe PID 2620 wrote to memory of 1196 2620 RtDCpl64.exe cmd.exe PID 2952 wrote to memory of 612 2952 taskeng.exe RtDCpl64.exe PID 2952 wrote to memory of 612 2952 taskeng.exe RtDCpl64.exe PID 2952 wrote to memory of 612 2952 taskeng.exe RtDCpl64.exe PID 2952 wrote to memory of 612 2952 taskeng.exe RtDCpl64.exe PID 612 wrote to memory of 1464 612 RtDCpl64.exe Blasthost.exe PID 612 wrote to memory of 1464 612 RtDCpl64.exe Blasthost.exe PID 612 wrote to memory of 1464 612 RtDCpl64.exe Blasthost.exe PID 612 wrote to memory of 1464 612 RtDCpl64.exe Blasthost.exe PID 612 wrote to memory of 1124 612 RtDCpl64.exe RtDCpl64.exe PID 612 wrote to memory of 1124 612 RtDCpl64.exe RtDCpl64.exe PID 612 wrote to memory of 1124 612 RtDCpl64.exe RtDCpl64.exe PID 612 wrote to memory of 1124 612 RtDCpl64.exe RtDCpl64.exe PID 612 wrote to memory of 1124 612 RtDCpl64.exe RtDCpl64.exe PID 612 wrote to memory of 1124 612 RtDCpl64.exe RtDCpl64.exe PID 1124 wrote to memory of 2220 1124 RtDCpl64.exe cmd.exe PID 1124 wrote to memory of 2220 1124 RtDCpl64.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ddf4a2321982e95551f6e1b06e654ae.exe"C:\Users\Admin\AppData\Local\Temp\0ddf4a2321982e95551f6e1b06e654ae.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\0ddf4a2321982e95551f6e1b06e654ae.exe"C:\Users\Admin\AppData\Local\Temp\0ddf4a2321982e95551f6e1b06e654ae.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:2032
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:2740
-
C:\Windows\system32\taskeng.exetaskeng.exe {8C2A758F-DE43-4E92-9298-20435BFBD828} S-1-5-21-1658372521-4246568289-2509113762-1000:PIRBKNPS\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:2684 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:1196
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:2732 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:612 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1464 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵PID:2220
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
PID:1376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD56064ea35d7dd219b73f34c32837a7074
SHA14aa2a6bfeb35f774cb1c8fd68cd2b5b9a8fc48f6
SHA256bc0cde650b0102990fef365c8ab938450a85004d1b10ca984fb0e7179a0dceb9
SHA512f321c9acfe502e4a7b7b2317df22881f0b615cd2012822a80a9316af66d39890f9db558b6028ba8cd1aa81f7bf7170098a210616cd4d7528daf897a8ec3ec185
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292