Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
24-05-2024 08:40
Behavioral task
behavioral1
Sample
1099Misc.pdf
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
1099Misc.pdf
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
Tax_Documents_PDF.exe
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Tax_Documents_PDF.exe
Resource
win10v2004-20240426-en
Behavioral task
behavioral5
Sample
msimg32.dll
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
msimg32.dll
Resource
win10v2004-20240426-en
General
-
Target
msimg32.dll
-
Size
44.7MB
-
MD5
37ba2c97ca9a8503e796a726f23ebe6e
-
SHA1
3fd8be11bf7b6e951646d794802849e3af902a2b
-
SHA256
0bfb5c9035c5bccea26456a7a873e7f682055c5621a3c2ada16f7db9e4b49a39
-
SHA512
fb55a58099050b6c0062d8d5aeae5deefcadfe34ff2ed9046c17a390380af94f44d67025ddaad3b2e6aef5cbf4f795ed4a65749fc141dddc750531ed7abffa86
-
SSDEEP
786432:ieUP7GCGO7t0Srkx/tC0SzIdSwh/WxbpNHQD3trzRpw:XUP7GCG6iSrkx1hSzYsHQD3t/Rq
Malware Config
Extracted
warzonerat
5.253.84.218:6500
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule behavioral6/memory/1236-6-0x0000000001270000-0x00000000013CA000-memory.dmp warzonerat behavioral6/memory/1236-7-0x0000000001270000-0x00000000013CA000-memory.dmp warzonerat behavioral6/memory/2604-9-0x0000000010000000-0x0000000012D7C000-memory.dmp warzonerat behavioral6/memory/1236-11-0x0000000001270000-0x00000000013CA000-memory.dmp warzonerat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
reg.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\*ChromeUpdate = "rundll32.exe C:\\Users\\Admin\\Documents\\ChromeData.dll,EntryPoint" reg.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
Processes:
regsvr32.exepid process 2604 regsvr32.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
regsvr32.exeregsvr32.execmd.exedescription pid process target process PID 1476 wrote to memory of 2604 1476 regsvr32.exe regsvr32.exe PID 1476 wrote to memory of 2604 1476 regsvr32.exe regsvr32.exe PID 1476 wrote to memory of 2604 1476 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 1236 2604 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 1236 2604 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 1236 2604 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 1236 2604 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 1236 2604 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 1236 2604 regsvr32.exe regsvr32.exe PID 2604 wrote to memory of 4352 2604 regsvr32.exe cmd.exe PID 2604 wrote to memory of 4352 2604 regsvr32.exe cmd.exe PID 2604 wrote to memory of 4352 2604 regsvr32.exe cmd.exe PID 4352 wrote to memory of 3224 4352 cmd.exe reg.exe PID 4352 wrote to memory of 3224 4352 cmd.exe reg.exe PID 4352 wrote to memory of 3224 4352 cmd.exe reg.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\msimg32.dll1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\msimg32.dll2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\SysWOW64\regsvr32.exe"3⤵
-
C:\Windows\SysWOW64\cmd.execmd.exe /C reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "*ChromeUpdate" /t REG_SZ /d "rundll32.exe C:\Users\Admin\Documents\ChromeData.dll",EntryPoint /f4⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1236-6-0x0000000001270000-0x00000000013CA000-memory.dmpFilesize
1.4MB
-
memory/1236-7-0x0000000001270000-0x00000000013CA000-memory.dmpFilesize
1.4MB
-
memory/1236-3-0x00000000013D0000-0x00000000013D1000-memory.dmpFilesize
4KB
-
memory/1236-11-0x0000000001270000-0x00000000013CA000-memory.dmpFilesize
1.4MB
-
memory/2604-1-0x00000000102E6000-0x0000000010300000-memory.dmpFilesize
104KB
-
memory/2604-0-0x0000000010000000-0x0000000012D7C000-memory.dmpFilesize
45.5MB
-
memory/2604-2-0x0000000010000000-0x0000000012D7C000-memory.dmpFilesize
45.5MB
-
memory/2604-9-0x0000000010000000-0x0000000012D7C000-memory.dmpFilesize
45.5MB
-
memory/2604-10-0x0000000012D1E000-0x0000000012D22000-memory.dmpFilesize
16KB