General
-
Target
http://web.archive.org
-
Sample
240713-r9atjavfnj
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://web.archive.org
Resource
win10v2004-20240709-en
Malware Config
Extracted
asyncrat
1.0.7
Default
95.216.52.21:7575
xdnqiaxygefjfoolgo
-
delay
1
-
install
false
-
install_folder
%AppData%
Extracted
azorult
http://boglogov.site/index.php
Extracted
warzonerat
168.61.222.215:5400
Extracted
asyncrat
Venom RAT + HVNC + Stealer + Grabber v6.0.3
Default
127.0.0.1:4449
wyaabxgdjmk
-
delay
1
-
install
false
-
install_folder
%AppData%
Targets
-
-
Target
http://web.archive.org
-
Azorult
An information stealer that was first discovered in 2016, targeting browsing history and passwords.
-
Modifies visiblity of hidden/system files in Explorer
-
Quasar payload
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Grants admin privileges
Uses net.exe to modify the user's privileges.
-
Warzone RAT payload
-
Blocks application from running via registry modification
Adds application to list of disallowed applications.
-
Downloads MZ/PE file
-
Drops file in Drivers directory
-
Modifies Windows Firewall
-
Server Software Component: Terminal Services DLL
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Modifies file permissions
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Modifies WinLogon
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
-
Hide Artifacts: Hidden Users
-
Suspicious use of SetThreadContext
-
MITRE ATT&CK Matrix ATT&CK v13
Execution
System Services
1Service Execution
1Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Create or Modify System Process
3Windows Service
3Account Manipulation
1Server Software Component
1Terminal Services DLL
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Create or Modify System Process
3Windows Service
3Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Modify Registry
8Impair Defenses
5Disable or Modify Tools
3Disable or Modify System Firewall
1Hide Artifacts
4Hidden Files and Directories
3Hidden Users
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Subvert Trust Controls
1Install Root Certificate
1