Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
24-05-2024 19:49
Behavioral task
behavioral1
Sample
277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe
Resource
win10v2004-20240508-en
General
-
Target
277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe
-
Size
1.3MB
-
MD5
0847ef76da389f114854f9244b3719f6
-
SHA1
d1d1ec03a4cfb5d74c81503c1eeacf2ab7b0cddd
-
SHA256
277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b
-
SHA512
6a4eea2fe67ba6186eab8d23ff8db8a8ab7e3ad9de97f620d339217279d1a40d5a0b2278ff0da79101333d6008c33c3e8a980f0732ac829e954b7b134457d863
-
SSDEEP
24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYH:8u0c++OCvkGs9Fa+rd1f26RaYH
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Roaming\Blasthost.exe netwire behavioral1/memory/1740-24-0x0000000000400000-0x000000000042C000-memory.dmp netwire C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe netwire behavioral1/memory/2924-80-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/3024-82-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2924-87-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2648-37-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2648-27-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat -
Executes dropped EXE 11 IoCs
Processes:
Blasthost.exeHost.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exepid process 1740 Blasthost.exe 2924 Host.exe 2384 RtDCpl64.exe 3024 Blasthost.exe 696 RtDCpl64.exe 2784 RtDCpl64.exe 2212 Blasthost.exe 1992 RtDCpl64.exe 2024 RtDCpl64.exe 2124 Blasthost.exe 1612 RtDCpl64.exe -
Loads dropped DLL 16 IoCs
Processes:
277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exepid process 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 1740 Blasthost.exe 1740 Blasthost.exe 2384 RtDCpl64.exe 2384 RtDCpl64.exe 2384 RtDCpl64.exe 2384 RtDCpl64.exe 2784 RtDCpl64.exe 2784 RtDCpl64.exe 2784 RtDCpl64.exe 2024 RtDCpl64.exe 2024 RtDCpl64.exe 2024 RtDCpl64.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 2696 set thread context of 2648 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe PID 2384 set thread context of 696 2384 RtDCpl64.exe RtDCpl64.exe PID 2784 set thread context of 1992 2784 RtDCpl64.exe RtDCpl64.exe PID 2024 set thread context of 1612 2024 RtDCpl64.exe RtDCpl64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2652 schtasks.exe 2020 schtasks.exe 2232 schtasks.exe 2828 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exeBlasthost.exe277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exetaskeng.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 2696 wrote to memory of 1740 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe Blasthost.exe PID 2696 wrote to memory of 1740 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe Blasthost.exe PID 2696 wrote to memory of 1740 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe Blasthost.exe PID 2696 wrote to memory of 1740 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe Blasthost.exe PID 1740 wrote to memory of 2924 1740 Blasthost.exe Host.exe PID 1740 wrote to memory of 2924 1740 Blasthost.exe Host.exe PID 1740 wrote to memory of 2924 1740 Blasthost.exe Host.exe PID 1740 wrote to memory of 2924 1740 Blasthost.exe Host.exe PID 2696 wrote to memory of 2648 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe PID 2696 wrote to memory of 2648 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe PID 2696 wrote to memory of 2648 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe PID 2696 wrote to memory of 2648 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe PID 2696 wrote to memory of 2648 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe PID 2696 wrote to memory of 2648 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe PID 2696 wrote to memory of 2652 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe schtasks.exe PID 2696 wrote to memory of 2652 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe schtasks.exe PID 2696 wrote to memory of 2652 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe schtasks.exe PID 2696 wrote to memory of 2652 2696 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe schtasks.exe PID 2648 wrote to memory of 2732 2648 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe cmd.exe PID 2648 wrote to memory of 2732 2648 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe cmd.exe PID 2648 wrote to memory of 2732 2648 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe cmd.exe PID 2648 wrote to memory of 2732 2648 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe cmd.exe PID 2648 wrote to memory of 2732 2648 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe cmd.exe PID 2648 wrote to memory of 2732 2648 277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe cmd.exe PID 2244 wrote to memory of 2384 2244 taskeng.exe RtDCpl64.exe PID 2244 wrote to memory of 2384 2244 taskeng.exe RtDCpl64.exe PID 2244 wrote to memory of 2384 2244 taskeng.exe RtDCpl64.exe PID 2244 wrote to memory of 2384 2244 taskeng.exe RtDCpl64.exe PID 2384 wrote to memory of 3024 2384 RtDCpl64.exe Blasthost.exe PID 2384 wrote to memory of 3024 2384 RtDCpl64.exe Blasthost.exe PID 2384 wrote to memory of 3024 2384 RtDCpl64.exe Blasthost.exe PID 2384 wrote to memory of 3024 2384 RtDCpl64.exe Blasthost.exe PID 2384 wrote to memory of 696 2384 RtDCpl64.exe RtDCpl64.exe PID 2384 wrote to memory of 696 2384 RtDCpl64.exe RtDCpl64.exe PID 2384 wrote to memory of 696 2384 RtDCpl64.exe RtDCpl64.exe PID 2384 wrote to memory of 696 2384 RtDCpl64.exe RtDCpl64.exe PID 2384 wrote to memory of 696 2384 RtDCpl64.exe RtDCpl64.exe PID 2384 wrote to memory of 696 2384 RtDCpl64.exe RtDCpl64.exe PID 2384 wrote to memory of 2020 2384 RtDCpl64.exe schtasks.exe PID 2384 wrote to memory of 2020 2384 RtDCpl64.exe schtasks.exe PID 2384 wrote to memory of 2020 2384 RtDCpl64.exe schtasks.exe PID 2384 wrote to memory of 2020 2384 RtDCpl64.exe schtasks.exe PID 696 wrote to memory of 756 696 RtDCpl64.exe cmd.exe PID 696 wrote to memory of 756 696 RtDCpl64.exe cmd.exe PID 696 wrote to memory of 756 696 RtDCpl64.exe cmd.exe PID 696 wrote to memory of 756 696 RtDCpl64.exe cmd.exe PID 696 wrote to memory of 756 696 RtDCpl64.exe cmd.exe PID 696 wrote to memory of 756 696 RtDCpl64.exe cmd.exe PID 2244 wrote to memory of 2784 2244 taskeng.exe RtDCpl64.exe PID 2244 wrote to memory of 2784 2244 taskeng.exe RtDCpl64.exe PID 2244 wrote to memory of 2784 2244 taskeng.exe RtDCpl64.exe PID 2244 wrote to memory of 2784 2244 taskeng.exe RtDCpl64.exe PID 2784 wrote to memory of 2212 2784 RtDCpl64.exe Blasthost.exe PID 2784 wrote to memory of 2212 2784 RtDCpl64.exe Blasthost.exe PID 2784 wrote to memory of 2212 2784 RtDCpl64.exe Blasthost.exe PID 2784 wrote to memory of 2212 2784 RtDCpl64.exe Blasthost.exe PID 2784 wrote to memory of 1992 2784 RtDCpl64.exe RtDCpl64.exe PID 2784 wrote to memory of 1992 2784 RtDCpl64.exe RtDCpl64.exe PID 2784 wrote to memory of 1992 2784 RtDCpl64.exe RtDCpl64.exe PID 2784 wrote to memory of 1992 2784 RtDCpl64.exe RtDCpl64.exe PID 2784 wrote to memory of 1992 2784 RtDCpl64.exe RtDCpl64.exe PID 2784 wrote to memory of 1992 2784 RtDCpl64.exe RtDCpl64.exe PID 2784 wrote to memory of 2232 2784 RtDCpl64.exe schtasks.exe PID 2784 wrote to memory of 2232 2784 RtDCpl64.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe"C:\Users\Admin\AppData\Local\Temp\277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe"C:\Users\Admin\AppData\Local\Temp\277448b931d9cdb6ac88e13edfdf1db01ae817a31c127af51c2668e1d8c49d2b.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {C0809AE8-9C41-4144-95D9-9BC7CB8FFBB5} S-1-5-21-330940541-141609230-1670313778-1000:KXIPPCKF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeFilesize
1.3MB
MD593b9be9956c531c6b9e6037a00056696
SHA195691f4659169c80c12788995293ccd2f126a7a8
SHA256f9d7e0a8c3b106e9d55addf3fe42e974e2595f8e6ea818d222794a0a14fa3738
SHA512ac14d297c71ec72050e6d619e0ed3cd5719e72ebc9b80c2e26f51ddf35c00af7cb0e26beed2d04be33c8335ea95bcd3102b6a5dd627c5b04e0c0b490bd070500
-
\Users\Admin\AppData\Roaming\Blasthost.exeFilesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
-
memory/696-71-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/756-77-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1740-24-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2648-37-0x0000000000080000-0x000000000009D000-memory.dmpFilesize
116KB
-
memory/2648-34-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2648-27-0x0000000000080000-0x000000000009D000-memory.dmpFilesize
116KB
-
memory/2648-25-0x0000000000080000-0x000000000009D000-memory.dmpFilesize
116KB
-
memory/2696-38-0x0000000000390000-0x0000000000391000-memory.dmpFilesize
4KB
-
memory/2732-42-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2732-40-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB
-
memory/2924-80-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2924-87-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3016-112-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/3024-82-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB