Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-04-2024 14:43

General

  • Target

    13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310.exe

  • Size

    532KB

  • MD5

    bac1beef11c340ae6632b50d2ce1fb80

  • SHA1

    eed74625db691bb0d498afec7b5b376e83bf5ff1

  • SHA256

    13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310

  • SHA512

    1486f2cf857b0f2dbd4717adebe266b86d8efd0d5554751349606d51844bb77e59d85dda5246c414902d2029ef5d6c895ac417fd7d47556978f7f3fd063ac8b6

  • SSDEEP

    12288:XePFLVoq3FMItDhVug2npXPCqCAVzDU17u+vpBze+kkNSLy5eZ870W:XePRVoMFMIt/+FxM7le+3NJi

Malware Config

Extracted

Family

warzonerat

C2

173.249.202.75:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload 6 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 48 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310.exe
    "C:\Users\Admin\AppData\Local\Temp\13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2900
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tstbRYA.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2472
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tstbRYA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB7A7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3748
    • C:\Users\Admin\AppData\Local\Temp\13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310.exe
      "C:\Users\Admin\AppData\Local\Temp\13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious use of WriteProcessMemory
      PID:3764
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Add-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2592
      • C:\ProgramData\images.exe
        "C:\ProgramData\images.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:244
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tstbRYA.exe"
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2180
        • C:\Windows\SysWOW64\schtasks.exe
          "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tstbRYA" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC6.tmp"
          4⤵
          • Creates scheduled task(s)
          PID:2500
        • C:\ProgramData\images.exe
          "C:\ProgramData\images.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of WriteProcessMemory
          PID:3988
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell Add-MpPreference -ExclusionPath C:\
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4348
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe"
            5⤵
              PID:4400

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\images.exe

      Filesize

      532KB

      MD5

      bac1beef11c340ae6632b50d2ce1fb80

      SHA1

      eed74625db691bb0d498afec7b5b376e83bf5ff1

      SHA256

      13a1de911837a6848b57e4e794892372e0d19339448f9075958e21c1071cf310

      SHA512

      1486f2cf857b0f2dbd4717adebe266b86d8efd0d5554751349606d51844bb77e59d85dda5246c414902d2029ef5d6c895ac417fd7d47556978f7f3fd063ac8b6

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      3730ea765a5ccd197fef6d8d7caf9fa1

      SHA1

      4a88b89ce7c41dea07ff2319a1f6172ab315f48d

      SHA256

      7153b7966eaad9611d17105e96406deef1cd1f7f0b3f4dae999f253add49cf3b

      SHA512

      5de0c654db7510fc888fbaa314d8fc6cf106d7fdc21a210a589ffb4646628d052707382a646f504fa834c6cec9be1714c285dbeb8d4fbb2ca77f0fc598973e79

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      8cb4600a759d0db1cbb8e624646a10d2

      SHA1

      98d187cbc283e12065056017bc19bbf788e89535

      SHA256

      f991e30debee8fff2d85e0cea3020877291e6585169f09a26ccce4141aae150e

      SHA512

      fbca2949fe260b3ccc3a53060fbe6b6dcf19fadce1299b77f977b17e50ee7c0a29f2f0e0056179f016c73bf94c5ea9c2206b2311ab944618364a2049f7fc0234

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1upuxtsx.dt1.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpB7A7.tmp

      Filesize

      1KB

      MD5

      3ef3cc5ec6c0f2ac3a75cbe9c0e4adba

      SHA1

      18c2b1b2259aac09aa0e2b7016a622774984883c

      SHA256

      df7dabf44d33810705c425dfb5a4ceeeb7bcd3844d24eb8e8e012f8b22633a5b

      SHA512

      9db666bcafa103be9101c0546191d1578e809e2eb3b99603afede8bfaf600efc2eac8d2d1ae968fd513fefd274df7e18bc1bdcafdd84b001edb15bbe000d5af8

    • memory/244-65-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/244-70-0x0000000005500000-0x0000000005510000-memory.dmp

      Filesize

      64KB

    • memory/244-105-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/244-116-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/244-108-0x0000000005500000-0x0000000005510000-memory.dmp

      Filesize

      64KB

    • memory/2180-140-0x0000000005110000-0x0000000005120000-memory.dmp

      Filesize

      64KB

    • memory/2180-109-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2180-110-0x0000000005110000-0x0000000005120000-memory.dmp

      Filesize

      64KB

    • memory/2180-123-0x0000000005F10000-0x0000000006264000-memory.dmp

      Filesize

      3.3MB

    • memory/2180-129-0x0000000006B20000-0x0000000006B6C000-memory.dmp

      Filesize

      304KB

    • memory/2180-130-0x0000000071020000-0x000000007106C000-memory.dmp

      Filesize

      304KB

    • memory/2180-141-0x0000000007830000-0x00000000078D3000-memory.dmp

      Filesize

      652KB

    • memory/2180-142-0x0000000007B00000-0x0000000007B11000-memory.dmp

      Filesize

      68KB

    • memory/2180-143-0x0000000007B30000-0x0000000007B44000-memory.dmp

      Filesize

      80KB

    • memory/2472-100-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2472-82-0x0000000007B20000-0x0000000007B2E000-memory.dmp

      Filesize

      56KB

    • memory/2472-15-0x0000000005020000-0x0000000005056000-memory.dmp

      Filesize

      216KB

    • memory/2472-18-0x0000000005690000-0x0000000005CB8000-memory.dmp

      Filesize

      6.2MB

    • memory/2472-19-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2472-29-0x0000000005F60000-0x0000000005FC6000-memory.dmp

      Filesize

      408KB

    • memory/2472-26-0x0000000005510000-0x0000000005532000-memory.dmp

      Filesize

      136KB

    • memory/2472-32-0x0000000005FD0000-0x0000000006324000-memory.dmp

      Filesize

      3.3MB

    • memory/2472-42-0x00000000065D0000-0x00000000065EE000-memory.dmp

      Filesize

      120KB

    • memory/2472-43-0x0000000006660000-0x00000000066AC000-memory.dmp

      Filesize

      304KB

    • memory/2472-44-0x000000007F3F0000-0x000000007F400000-memory.dmp

      Filesize

      64KB

    • memory/2472-45-0x0000000006BA0000-0x0000000006BD2000-memory.dmp

      Filesize

      200KB

    • memory/2472-46-0x0000000072360000-0x00000000723AC000-memory.dmp

      Filesize

      304KB

    • memory/2472-56-0x0000000006B80000-0x0000000006B9E000-memory.dmp

      Filesize

      120KB

    • memory/2472-57-0x00000000075F0000-0x0000000007693000-memory.dmp

      Filesize

      652KB

    • memory/2472-58-0x0000000007F40000-0x00000000085BA000-memory.dmp

      Filesize

      6.5MB

    • memory/2472-59-0x00000000078F0000-0x000000000790A000-memory.dmp

      Filesize

      104KB

    • memory/2472-20-0x0000000002C30000-0x0000000002C40000-memory.dmp

      Filesize

      64KB

    • memory/2472-85-0x0000000007C10000-0x0000000007C18000-memory.dmp

      Filesize

      32KB

    • memory/2472-64-0x0000000007960000-0x000000000796A000-memory.dmp

      Filesize

      40KB

    • memory/2472-84-0x0000000007C30000-0x0000000007C4A000-memory.dmp

      Filesize

      104KB

    • memory/2472-83-0x0000000007B30000-0x0000000007B44000-memory.dmp

      Filesize

      80KB

    • memory/2472-67-0x0000000007B70000-0x0000000007C06000-memory.dmp

      Filesize

      600KB

    • memory/2472-28-0x0000000005EF0000-0x0000000005F56000-memory.dmp

      Filesize

      408KB

    • memory/2472-21-0x0000000002C30000-0x0000000002C40000-memory.dmp

      Filesize

      64KB

    • memory/2472-81-0x0000000007AF0000-0x0000000007B01000-memory.dmp

      Filesize

      68KB

    • memory/2592-97-0x00000000024E0000-0x00000000024F0000-memory.dmp

      Filesize

      64KB

    • memory/2592-69-0x00000000024E0000-0x00000000024F0000-memory.dmp

      Filesize

      64KB

    • memory/2592-68-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2592-71-0x00000000024E0000-0x00000000024F0000-memory.dmp

      Filesize

      64KB

    • memory/2592-104-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2592-86-0x000000007F030000-0x000000007F040000-memory.dmp

      Filesize

      64KB

    • memory/2592-87-0x0000000072360000-0x00000000723AC000-memory.dmp

      Filesize

      304KB

    • memory/2900-6-0x00000000064B0000-0x00000000064D0000-memory.dmp

      Filesize

      128KB

    • memory/2900-4-0x00000000051E0000-0x00000000051F0000-memory.dmp

      Filesize

      64KB

    • memory/2900-22-0x00000000051E0000-0x00000000051F0000-memory.dmp

      Filesize

      64KB

    • memory/2900-1-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2900-2-0x00000000055D0000-0x0000000005B74000-memory.dmp

      Filesize

      5.6MB

    • memory/2900-30-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2900-17-0x0000000074C90000-0x0000000075440000-memory.dmp

      Filesize

      7.7MB

    • memory/2900-3-0x0000000005020000-0x00000000050B2000-memory.dmp

      Filesize

      584KB

    • memory/2900-10-0x000000000F930000-0x000000000F9CC000-memory.dmp

      Filesize

      624KB

    • memory/2900-9-0x000000000C2B0000-0x000000000C30C000-memory.dmp

      Filesize

      368KB

    • memory/2900-0-0x0000000000520000-0x00000000005AC000-memory.dmp

      Filesize

      560KB

    • memory/2900-5-0x0000000004FA0000-0x0000000004FAA000-memory.dmp

      Filesize

      40KB

    • memory/2900-8-0x00000000027F0000-0x00000000027FE000-memory.dmp

      Filesize

      56KB

    • memory/2900-7-0x0000000005350000-0x000000000535A000-memory.dmp

      Filesize

      40KB

    • memory/3764-66-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3764-27-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3764-23-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3764-31-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3988-117-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3988-115-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/4400-173-0x0000000000B10000-0x0000000000B11000-memory.dmp

      Filesize

      4KB