Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
12/08/2024, 22:02
Behavioral task
behavioral1
Sample
aae319ebec505024b3606e2e571030a0N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
aae319ebec505024b3606e2e571030a0N.exe
Resource
win10v2004-20240802-en
General
-
Target
aae319ebec505024b3606e2e571030a0N.exe
-
Size
1.4MB
-
MD5
aae319ebec505024b3606e2e571030a0
-
SHA1
6e6b8a07cda298c125a68d7c9f44e8fa5b16e406
-
SHA256
28683bc66a104f94d7e164edeacd0e76b7d91cdf6a77a26c5e3d1fa477f5da9c
-
SHA512
71ec0458b34ff5472911fa80a017eee49287fd0fc0118749ef508d1f1bdd24864186512056210467d98763ba372d60c27cc4bbb14d08c85ac50827c9300b238d
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYB:Fo0c++OCokGs9Fa+rd1f26RNYB
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 16 IoCs
resource yara_rule behavioral2/memory/2756-0-0x0000000000DA0000-0x0000000000F0B000-memory.dmp netwire behavioral2/files/0x0008000000023459-5.dat netwire behavioral2/memory/1492-13-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/2320-24-0x0000000000DA0000-0x0000000000F0B000-memory.dmp netwire behavioral2/memory/2756-26-0x0000000000DA0000-0x0000000000F0B000-memory.dmp netwire behavioral2/memory/1184-29-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/files/0x0007000000023462-33.dat netwire behavioral2/memory/3200-35-0x0000000000BF0000-0x0000000000D5B000-memory.dmp netwire behavioral2/memory/4640-51-0x0000000000BF0000-0x0000000000D5B000-memory.dmp netwire behavioral2/memory/3200-53-0x0000000000BF0000-0x0000000000D5B000-memory.dmp netwire behavioral2/memory/2168-58-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/1184-61-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/2168-64-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/2232-69-0x0000000000BF0000-0x0000000000D5B000-memory.dmp netwire behavioral2/memory/2232-81-0x0000000000BF0000-0x0000000000D5B000-memory.dmp netwire behavioral2/memory/748-86-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/memory/2320-14-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/2320-23-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4640-43-0x0000000000320000-0x000000000033D000-memory.dmp warzonerat behavioral2/memory/4640-52-0x0000000000320000-0x000000000033D000-memory.dmp warzonerat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation aae319ebec505024b3606e2e571030a0N.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation RtDCpl64.exe -
Executes dropped EXE 8 IoCs
pid Process 1492 Blasthost.exe 1184 Host.exe 3200 RtDCpl64.exe 2168 Blasthost.exe 4640 RtDCpl64.exe 2232 RtDCpl64.exe 748 Blasthost.exe 3744 RtDCpl64.exe -
AutoIT Executable 9 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2756-0-0x0000000000DA0000-0x0000000000F0B000-memory.dmp autoit_exe behavioral2/memory/2320-24-0x0000000000DA0000-0x0000000000F0B000-memory.dmp autoit_exe behavioral2/memory/2756-26-0x0000000000DA0000-0x0000000000F0B000-memory.dmp autoit_exe behavioral2/files/0x0007000000023462-33.dat autoit_exe behavioral2/memory/3200-35-0x0000000000BF0000-0x0000000000D5B000-memory.dmp autoit_exe behavioral2/memory/4640-51-0x0000000000BF0000-0x0000000000D5B000-memory.dmp autoit_exe behavioral2/memory/3200-53-0x0000000000BF0000-0x0000000000D5B000-memory.dmp autoit_exe behavioral2/memory/2232-69-0x0000000000BF0000-0x0000000000D5B000-memory.dmp autoit_exe behavioral2/memory/2232-81-0x0000000000BF0000-0x0000000000D5B000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2756 set thread context of 2320 2756 aae319ebec505024b3606e2e571030a0N.exe 90 PID 3200 set thread context of 4640 3200 RtDCpl64.exe 105 PID 2232 set thread context of 3744 2232 RtDCpl64.exe 117 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aae319ebec505024b3606e2e571030a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aae319ebec505024b3606e2e571030a0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3252 schtasks.exe 2448 schtasks.exe 628 schtasks.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2756 wrote to memory of 1492 2756 aae319ebec505024b3606e2e571030a0N.exe 87 PID 2756 wrote to memory of 1492 2756 aae319ebec505024b3606e2e571030a0N.exe 87 PID 2756 wrote to memory of 1492 2756 aae319ebec505024b3606e2e571030a0N.exe 87 PID 1492 wrote to memory of 1184 1492 Blasthost.exe 89 PID 1492 wrote to memory of 1184 1492 Blasthost.exe 89 PID 1492 wrote to memory of 1184 1492 Blasthost.exe 89 PID 2756 wrote to memory of 2320 2756 aae319ebec505024b3606e2e571030a0N.exe 90 PID 2756 wrote to memory of 2320 2756 aae319ebec505024b3606e2e571030a0N.exe 90 PID 2756 wrote to memory of 2320 2756 aae319ebec505024b3606e2e571030a0N.exe 90 PID 2756 wrote to memory of 2320 2756 aae319ebec505024b3606e2e571030a0N.exe 90 PID 2756 wrote to memory of 2320 2756 aae319ebec505024b3606e2e571030a0N.exe 90 PID 2320 wrote to memory of 60 2320 aae319ebec505024b3606e2e571030a0N.exe 91 PID 2320 wrote to memory of 60 2320 aae319ebec505024b3606e2e571030a0N.exe 91 PID 2320 wrote to memory of 60 2320 aae319ebec505024b3606e2e571030a0N.exe 91 PID 2756 wrote to memory of 3252 2756 aae319ebec505024b3606e2e571030a0N.exe 93 PID 2756 wrote to memory of 3252 2756 aae319ebec505024b3606e2e571030a0N.exe 93 PID 2756 wrote to memory of 3252 2756 aae319ebec505024b3606e2e571030a0N.exe 93 PID 2320 wrote to memory of 60 2320 aae319ebec505024b3606e2e571030a0N.exe 91 PID 2320 wrote to memory of 60 2320 aae319ebec505024b3606e2e571030a0N.exe 91 PID 3200 wrote to memory of 2168 3200 RtDCpl64.exe 104 PID 3200 wrote to memory of 2168 3200 RtDCpl64.exe 104 PID 3200 wrote to memory of 2168 3200 RtDCpl64.exe 104 PID 3200 wrote to memory of 4640 3200 RtDCpl64.exe 105 PID 3200 wrote to memory of 4640 3200 RtDCpl64.exe 105 PID 3200 wrote to memory of 4640 3200 RtDCpl64.exe 105 PID 3200 wrote to memory of 4640 3200 RtDCpl64.exe 105 PID 3200 wrote to memory of 4640 3200 RtDCpl64.exe 105 PID 4640 wrote to memory of 1616 4640 RtDCpl64.exe 106 PID 4640 wrote to memory of 1616 4640 RtDCpl64.exe 106 PID 4640 wrote to memory of 1616 4640 RtDCpl64.exe 106 PID 3200 wrote to memory of 2448 3200 RtDCpl64.exe 108 PID 3200 wrote to memory of 2448 3200 RtDCpl64.exe 108 PID 3200 wrote to memory of 2448 3200 RtDCpl64.exe 108 PID 4640 wrote to memory of 1616 4640 RtDCpl64.exe 106 PID 4640 wrote to memory of 1616 4640 RtDCpl64.exe 106 PID 2232 wrote to memory of 748 2232 RtDCpl64.exe 116 PID 2232 wrote to memory of 748 2232 RtDCpl64.exe 116 PID 2232 wrote to memory of 748 2232 RtDCpl64.exe 116 PID 2232 wrote to memory of 3744 2232 RtDCpl64.exe 117 PID 2232 wrote to memory of 3744 2232 RtDCpl64.exe 117 PID 2232 wrote to memory of 3744 2232 RtDCpl64.exe 117 PID 2232 wrote to memory of 3744 2232 RtDCpl64.exe 117 PID 2232 wrote to memory of 3744 2232 RtDCpl64.exe 117 PID 2232 wrote to memory of 628 2232 RtDCpl64.exe 118 PID 2232 wrote to memory of 628 2232 RtDCpl64.exe 118 PID 2232 wrote to memory of 628 2232 RtDCpl64.exe 118 PID 3744 wrote to memory of 4940 3744 RtDCpl64.exe 119 PID 3744 wrote to memory of 4940 3744 RtDCpl64.exe 119 PID 3744 wrote to memory of 4940 3744 RtDCpl64.exe 119 PID 3744 wrote to memory of 4940 3744 RtDCpl64.exe 119 PID 3744 wrote to memory of 4940 3744 RtDCpl64.exe 119
Processes
-
C:\Users\Admin\AppData\Local\Temp\aae319ebec505024b3606e2e571030a0N.exe"C:\Users\Admin\AppData\Local\Temp\aae319ebec505024b3606e2e571030a0N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1184
-
-
-
C:\Users\Admin\AppData\Local\Temp\aae319ebec505024b3606e2e571030a0N.exe"C:\Users\Admin\AppData\Local\Temp\aae319ebec505024b3606e2e571030a0N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:60
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3252
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:2168
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1616
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2448
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:748
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3744 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4940
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
-
Filesize
1.4MB
MD5ce12174c219411f476e395dbd7f89bbc
SHA14ba2c03777e8faa8884aa23d31a95d462b53ba07
SHA2567b78d7a49d8e0881866220a4ef29e7a0abd7100193049ab82e8956d7a33c490d
SHA5121df8d5a196a972a003846c5b365c0c556960bde7d6d753c83af2038c356c9f5192e735e32d2f5fce184bbc82bfda072e428bce4dbb60100ed10cee4d6543f0ad