Resubmissions

03-07-2024 16:04

240703-thygmaycpc 10

01-07-2024 18:12

240701-ws6xvswbkj 10

01-07-2024 18:03

240701-wm5sls1gka 10

01-07-2024 18:03

240701-wm39sa1gjf 10

01-07-2024 18:03

240701-wm2e7avhkj 10

01-07-2024 18:03

240701-wmzxcs1fre 10

01-07-2024 18:02

240701-wmzats1frc 10

01-07-2024 18:02

240701-wmvbwa1fqh 10

22-11-2023 17:02

231122-vkac9adg64 10

Analysis

  • max time kernel
    32s
  • max time network
    156s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    01-07-2024 18:03

General

  • Target

    42f972925508a82236e8533567487761(1).exe

  • Size

    3.7MB

  • MD5

    9d2a888ca79e1ff3820882ea1d88d574

  • SHA1

    112c38d80bf2c0d48256249bbabe906b834b1f66

  • SHA256

    8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

  • SHA512

    17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

  • SSDEEP

    98304:Nn1CVf+y/EFc7DvOUxlpq2JdnQ+O2M7hlXKUmkbtT2TMI:A/EqaUFqItO2M7PXKUmkbtT2T

Malware Config

Extracted

Family

warzonerat

C2

sandyclark255.hopto.org:5200

Extracted

Family

darkcomet

Botnet

2020NOV1

C2

sandyclark255.hopto.org:35887

Mutex

DC_MUTEX-6XT818D

Attributes
  • InstallPath

    excelsl.exe

  • gencode

    n7asq0Dbu7D2

  • install

    true

  • offline_keylogger

    true

  • password

    hhhhhh

  • persistence

    true

  • reg_key

    office

Extracted

Family

asyncrat

Version

0.5.6A

C2

sandyclark255.hopto.org:6606

sandyclark255.hopto.org:8808

sandyclark255.hopto.org:7707

Mutex

adweqsds56332

Attributes
  • delay

    5

  • install

    true

  • install_file

    prndrvest.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Darkcomet

    DarkComet is a remote access trojan (RAT) developed by Jean-Pierre Lesueur.

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Async RAT payload 1 IoCs
  • Warzone RAT payload 6 IoCs
  • Modifies Windows Firewall 2 TTPs 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe
    "C:\Users\Admin\AppData\Local\Temp\42f972925508a82236e8533567487761(1).exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\UTdIkqTxOUtGyauX.exe
      "C:\Users\Admin\AppData\Local\Temp\UTdIkqTxOUtGyauX.exe"
      2⤵
      • Executes dropped EXE
      PID:2316
      • C:\Windows\svehosts.exe
        "C:\Windows\svehosts.exe"
        3⤵
          PID:2528
          • C:\Windows\SysWOW64\netsh.exe
            netsh firewall add allowedprogram "C:\Windows\svehosts.exe" "svehosts.exe" ENABLE
            4⤵
            • Modifies Windows Firewall
            PID:2144
      • C:\Users\Admin\AppData\Local\Temp\FMAvx0Q51GMAbAWG.exe
        "C:\Users\Admin\AppData\Local\Temp\FMAvx0Q51GMAbAWG.exe"
        2⤵
        • Executes dropped EXE
        PID:2152
        • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
          "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
          3⤵
            PID:1280
            • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
              "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe" 1280
              4⤵
                PID:2248
                • C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\RJCisDErBR6WU7D5\svbhost.exe"
                  5⤵
                    PID:2176
            • C:\Users\Admin\AppData\Local\Temp\a2LLCza60A8ebUiF.exe
              "C:\Users\Admin\AppData\Local\Temp\a2LLCza60A8ebUiF.exe"
              2⤵
                PID:2572
                • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                  "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                  3⤵
                    PID:2024
                    • C:\Windows\SysWOW64\notepad.exe
                      notepad
                      4⤵
                        PID:1928
                      • C:\Users\Admin\Documents\excelsl.exe
                        "C:\Users\Admin\Documents\excelsl.exe"
                        4⤵
                          PID:804
                          • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                            "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                            5⤵
                              PID:1684
                            • C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe
                              "C:\Users\Admin\AppData\Local\Temp\heCYMLXIPI2fpGWa\svuhost.exe"
                              5⤵
                                PID:948
                                • C:\Windows\SysWOW64\notepad.exe
                                  notepad
                                  6⤵
                                    PID:2932
                          • C:\Users\Admin\AppData\Local\Temp\yFgaBBNEg0p3Ek6x.exe
                            "C:\Users\Admin\AppData\Local\Temp\yFgaBBNEg0p3Ek6x.exe"
                            2⤵
                              PID:2608
                              • C:\Windows\SysWOW64\schtasks.exe
                                "C:\Windows\System32\schtasks.exe" /create /f /sc ONLOGON /RL HIGHEST /tn "'prndrvest"' /tr "'C:\Users\Admin\AppData\Roaming\prndrvest.exe"'
                                3⤵
                                • Scheduled Task/Job: Scheduled Task
                                PID:2552
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp416.tmp.bat""
                                3⤵
                                  PID:620
                                  • C:\Windows\SysWOW64\timeout.exe
                                    timeout 3
                                    4⤵
                                    • Delays execution with timeout.exe
                                    PID:2692
                                  • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                                    "C:\Users\Admin\AppData\Roaming\prndrvest.exe"
                                    4⤵
                                      PID:1608
                                • C:\Users\Admin\AppData\Local\Temp\LwrzPAXFfucYE3Kx.exe
                                  "C:\Users\Admin\AppData\Local\Temp\LwrzPAXFfucYE3Kx.exe"
                                  2⤵
                                    PID:2468
                                    • C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe
                                      "C:\Users\Admin\AppData\Local\Temp\fI87ltOJhCNhEwlw\eridjeht.exe"
                                      3⤵
                                        PID:796
                                    • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                      "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
                                      2⤵
                                        PID:2916
                                      • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                        "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
                                        2⤵
                                          PID:1444
                                        • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                          "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
                                          2⤵
                                            PID:1216
                                          • C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe"
                                            2⤵
                                              PID:1364

                                          Network

                                          MITRE ATT&CK Enterprise v15

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Temp\FMAvx0Q51GMAbAWG.exe
                                            Filesize

                                            801KB

                                            MD5

                                            9133c2a5ebf3e25aceae5a001ca6f279

                                            SHA1

                                            319f911282f3cded94de3730fa0abd5dec8f14be

                                            SHA256

                                            7c3615c405f7a11f1c217b9ecd1000cf60a37bca7da1f2d12da21cc110b16b4d

                                            SHA512

                                            1d1af3fcfcdba41874e3eb3e2571d25798acfd49b63b7fcf9393be2f59c9ba77e563da1717abcd6445fc52fd6d948bf4c0dd5978a192c8e32e0a9279fd0be33e

                                          • C:\Users\Admin\AppData\Local\Temp\LwrzPAXFfucYE3Kx.exe
                                            Filesize

                                            366KB

                                            MD5

                                            f07d2c33e4afe36ec6f6f14f9a56e84a

                                            SHA1

                                            3ebed0c1a265d1e17ce038dfaf1029387f0b53ee

                                            SHA256

                                            309385e6cd68c0dd148905c3147f77383edaf35da9609c0717da7df1a894e3ca

                                            SHA512

                                            b4fbf0e6b8e7e8e1679680039e4ac0aebdf7967a9cc36d9ddac35fa31d997253384a51656d886afb2ded9f911b7b8b44c2dcb8ebe71962e551c5025a4d75ebe2

                                          • C:\Users\Admin\AppData\Local\Temp\UTdIkqTxOUtGyauX.exe
                                            Filesize

                                            472KB

                                            MD5

                                            2819e45588024ba76f248a39d3e232ba

                                            SHA1

                                            08a797b87ecfbee682ce14d872177dae1a5a46a2

                                            SHA256

                                            b82b23059e398b39f183ec833d498200029033b0fd3a138b6c2064a6fa3c4b93

                                            SHA512

                                            a38b58768daf58fa56ca7b8c37826d57e9dbfcd2dedf120a5b7b9aa36c4e10f64ec07c11dbd77b5861236c005fe5d453523911906dd77a302634408f1d78503a

                                          • C:\Users\Admin\AppData\Local\Temp\a2LLCza60A8ebUiF.exe
                                            Filesize

                                            742KB

                                            MD5

                                            3e804917c454ca31c1cbd602682542b7

                                            SHA1

                                            1df3e81b9d879e21af299f5478051b98f3cb7739

                                            SHA256

                                            f9f7b6f7b8c5068f9e29a5b50afca609018c50ffd61929e1b78124f5381868f1

                                            SHA512

                                            28e59bc545179c2503771b93d947930bd56f8ebd0402ecbb398335c5ac89f40051e93fbfd84d35b8c625b253bb4cafea6a5360914b8d54d1bc121977f1eadbaf

                                          • C:\Users\Admin\AppData\Local\Temp\tmp416.tmp.bat
                                            Filesize

                                            152B

                                            MD5

                                            a306d7a3cc5b28cc3f6233c4a5174e82

                                            SHA1

                                            f3de1da841de884c4662cbf53d4027d0212419f9

                                            SHA256

                                            6b57ccdd004b524fdb99f27957162f076143aeb89cf69dfd5cc8b96cc16ee044

                                            SHA512

                                            45787ff2739ff54919fce0ada375171fd92cf4d6fa062d1cb959578ca9aabec50c8db8d499c7e135d4245a478f4491407358619e6b2be021d0ba5a53c523f132

                                          • C:\Users\Admin\AppData\Local\Temp\yFgaBBNEg0p3Ek6x.exe
                                            Filesize

                                            376KB

                                            MD5

                                            590acb5fa6b5c3001ebce3d67242aac4

                                            SHA1

                                            5df39906dc4e60f01b95783fc55af6128402d611

                                            SHA256

                                            7bf9b7b25cf1671e5640f8eeac149f9a4e8c9f6c63415f4bd61bccb10ddf8509

                                            SHA512

                                            4ac518140ee666491132525853f2843357d622fe351e59cca7ce3b054d665f77ad8987adddd601e6b1afe6903222d77cf3c41a5aa69e8caf0dcdc7656a43e9ba

                                          • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                                            Filesize

                                            14.9MB

                                            MD5

                                            ecf7c3b40a7b751a827f71b419bac122

                                            SHA1

                                            46ef4944f8608c1e8af77c3728e5b4aecc8b0b1a

                                            SHA256

                                            282bb18ed3ab5b4e98dba96432a5f6a51e88c41fd199185e7281f6e6dd2511fa

                                            SHA512

                                            d7fb8e0adf8bca19efcd2a25c9feea9618347fa9bda71f95675d503f28fbc5be88f71257c14c5c7d001289585d19e2a5f111759dcce7c40e9bf3deb2fb3d5d74

                                          • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                                            Filesize

                                            13.9MB

                                            MD5

                                            d22ffb464c54d36ab31fd7d142e601c5

                                            SHA1

                                            e14c446058182e127231f9317d129f21a9986c2e

                                            SHA256

                                            b11d54a8881a29bd20420308610b5585f5ab8d11b240c2df57d84dad306a47b6

                                            SHA512

                                            9a8ee9b5ae21faf787d6a1aa0c16a1cb068ebab896684eaab034b7589d85288ac15e9c033435ab6bd92678eb03636e2c533757b5b122f8e6e37872e349494fdd

                                          • C:\Users\Admin\AppData\Roaming\prndrvest.exe
                                            Filesize

                                            14.6MB

                                            MD5

                                            61ad3e6f0eb24082a6601611b5f96b4c

                                            SHA1

                                            c15fa5e88886eeb13e7ddccc575b60a27c2fe3ce

                                            SHA256

                                            02167726ddc7c45607742a8b9ef93c75ee94adebe957522df74e781ccf5e7431

                                            SHA512

                                            33f54b36b777bed0948f43ae0fc888edfac26ce8c4265d9ad01c32a62208f80e4a1bc5cf04fc0f2d83069a3beb8b185cc32b3a5f36590a346a6d75c409424b87

                                          • \Users\Admin\AppData\Local\Temp\6ax0Yc8236t6EQMa\svthost.exe
                                            Filesize

                                            3.7MB

                                            MD5

                                            9d2a888ca79e1ff3820882ea1d88d574

                                            SHA1

                                            112c38d80bf2c0d48256249bbabe906b834b1f66

                                            SHA256

                                            8b5b38085f12d51393ed5a481a554074d3c482d53ecd917f2f5dffdf3d2ee138

                                            SHA512

                                            17a9f74ecf9f118ed0252fa0bc6ce0f9758a4dc75f238cae304def9c37cd94623818dd4aef38826642ff9e549b7e6047318f8bf6de7edff2d61a298d0bf5c840

                                          • \Users\Admin\AppData\Roaming\prndrvest.exe
                                            Filesize

                                            13.9MB

                                            MD5

                                            ff4d0b13940493494c71b5b6cfe06a81

                                            SHA1

                                            963c030039103f5e9aedcf9c3a666e51ae0e0107

                                            SHA256

                                            24b06cf74829155530e8ffbd18a55dbb49dc10c5c0c4f0bfed901ed7aba8723a

                                            SHA512

                                            fee9b97bdf685a98e7e265fdfa04f4d9890e9d430db393b2db9598d925676ad1e8dd4af0604be36504d7d70e6785506e51aa25fd902ae4d28017260e3181a2b4

                                          • memory/796-84-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-88-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-90-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-94-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-96-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-98-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/796-99-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-101-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-92-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/796-86-0x0000000000400000-0x0000000000554000-memory.dmp
                                            Filesize

                                            1.3MB

                                          • memory/1364-71-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-69-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-76-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-75-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/1364-59-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-61-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-63-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-65-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-67-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1364-73-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/1608-287-0x0000000000310000-0x0000000000374000-memory.dmp
                                            Filesize

                                            400KB

                                          • memory/1608-288-0x0000000001D40000-0x0000000001D64000-memory.dmp
                                            Filesize

                                            144KB

                                          • memory/1612-0-0x0000000074411000-0x0000000074412000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/1612-78-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/1612-1-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/1612-2-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/1612-3-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/1928-132-0x0000000000080000-0x0000000000081000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/2024-125-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-124-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
                                            Filesize

                                            4KB

                                          • memory/2024-122-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-120-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-118-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-116-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-114-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-112-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-110-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2024-127-0x0000000000400000-0x00000000004BA000-memory.dmp
                                            Filesize

                                            744KB

                                          • memory/2152-41-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/2152-283-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/2316-21-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/2316-264-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/2316-20-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/2316-35-0x0000000074410000-0x00000000749BB000-memory.dmp
                                            Filesize

                                            5.7MB

                                          • memory/2608-161-0x0000000000650000-0x0000000000674000-memory.dmp
                                            Filesize

                                            144KB

                                          • memory/2608-192-0x0000000000350000-0x0000000000362000-memory.dmp
                                            Filesize

                                            72KB

                                          • memory/2608-104-0x0000000000520000-0x0000000000544000-memory.dmp
                                            Filesize

                                            144KB

                                          • memory/2608-79-0x0000000001090000-0x00000000010F4000-memory.dmp
                                            Filesize

                                            400KB