Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 13:49

General

  • Target

    3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e.exe

  • Size

    469KB

  • MD5

    46bbacb63c2f6c440be347e99210c3a3

  • SHA1

    8b3f6920bf657fd1973069540ec5990b2033e69a

  • SHA256

    3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e

  • SHA512

    f51dafe7612d294a70872064d9c8b1352598def99242134e4dd5aa03ef62614d3222d5b430a8bb26fa63b7e177ec7229467bae58b1e86a0775a052dcab38f7d8

  • SSDEEP

    6144:olJZfHKsHfGCZ71Cn3R1E1+hf6VkTJluAMHQaMWDLdzsaX4O6zTbw6hE4F0FDgCJ:oluqauAMeWm5OKU6O4eFFpd6MvV/lzD

Malware Config

Signatures

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • N/A. 1 IoCs

    N/A.

  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e.exe
    "C:\Users\Admin\AppData\Local\Temp\3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e.exe"
    1⤵
    • Loads dropped DLL
    • Drops file in System32 directory
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:3148
    • C:\Users\Admin\AppData\Local\Temp\3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e.exe
      "C:\Users\Admin\AppData\Local\Temp\3b0b1b064f6b84d3b68b541f073ddca759e01adbbb9c36e7b38e6707b941539e.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      PID:3436

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsjDC39.tmp\System.dll

    Filesize

    11KB

    MD5

    fc90dfb694d0e17b013d6f818bce41b0

    SHA1

    3243969886d640af3bfa442728b9f0dff9d5f5b0

    SHA256

    7fe77ca13121a113c59630a3dba0c8aaa6372e8082393274da8f8608c4ce4528

    SHA512

    324f13aa7a33c6408e2a57c3484d1691ecee7c3c1366de2bb8978c8dc66b18425d8cab5a32d1702c13c43703e36148a022263de7166afdce141da2b01169f1c6

  • memory/3148-57-0x0000000004A50000-0x0000000005C60000-memory.dmp

    Filesize

    18.1MB

  • memory/3148-58-0x0000000077A11000-0x0000000077B31000-memory.dmp

    Filesize

    1.1MB

  • memory/3148-59-0x0000000010000000-0x0000000010006000-memory.dmp

    Filesize

    24KB

  • memory/3148-64-0x0000000004A50000-0x0000000005C60000-memory.dmp

    Filesize

    18.1MB

  • memory/3148-77-0x0000000004A50000-0x0000000005C60000-memory.dmp

    Filesize

    18.1MB

  • memory/3436-60-0x00000000016E0000-0x00000000028F0000-memory.dmp

    Filesize

    18.1MB

  • memory/3436-61-0x0000000077A98000-0x0000000077A99000-memory.dmp

    Filesize

    4KB

  • memory/3436-62-0x0000000077A11000-0x0000000077B31000-memory.dmp

    Filesize

    1.1MB

  • memory/3436-70-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-74-0x00000000016E0000-0x00000000028F0000-memory.dmp

    Filesize

    18.1MB

  • memory/3436-75-0x00000000016E0000-0x00000000028F0000-memory.dmp

    Filesize

    18.1MB

  • memory/3436-78-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-79-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-80-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-81-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-82-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-83-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-84-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-85-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-86-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-87-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-88-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-89-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-90-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-91-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-92-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-93-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-94-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-95-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-96-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-97-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-98-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-99-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-100-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-101-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-102-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-103-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-104-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-105-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-106-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-107-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-108-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-109-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-110-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-111-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-112-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-113-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-114-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-115-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-116-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-117-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-118-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-119-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-121-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-120-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-124-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-125-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-126-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-127-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-128-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-129-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-130-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-131-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-132-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-133-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB

  • memory/3436-134-0x0000000000480000-0x00000000016D4000-memory.dmp

    Filesize

    18.3MB