Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
23-08-2024 20:44
Behavioral task
behavioral1
Sample
a66c7afdd58fb40f70d029833dbbaf10N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
a66c7afdd58fb40f70d029833dbbaf10N.exe
Resource
win10v2004-20240802-en
General
-
Target
a66c7afdd58fb40f70d029833dbbaf10N.exe
-
Size
1.3MB
-
MD5
a66c7afdd58fb40f70d029833dbbaf10
-
SHA1
65c1bf510a820f568c20625fe1ad6fcbd3e73078
-
SHA256
a7bcc33c8479a690e32d8f78ccfaed3223af54b2027cc41cffab5c7f15bedeea
-
SHA512
cd4a4aa553aac645cf00aeb3ec3daa1a921a1e5d346b3fde6030494d4189c897b1f34e26c40985f25f25194261ff1dd2602a383c4bddf527de5d81fe21168c55
-
SSDEEP
24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWYy:8u0c++OCvkGs9Fa+rd1f26RaYy
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 6 IoCs
resource yara_rule behavioral1/files/0x00080000000120fc-6.dat netwire behavioral1/memory/2424-24-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2240-44-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2240-45-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/files/0x00060000000186c4-49.dat netwire behavioral1/memory/2484-86-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral1/memory/2844-27-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2844-37-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2800-69-0x00000000000C0000-0x00000000000DD000-memory.dmp warzonerat behavioral1/memory/2800-78-0x00000000000C0000-0x00000000000DD000-memory.dmp warzonerat -
Executes dropped EXE 8 IoCs
pid Process 2424 Blasthost.exe 2240 Host.exe 2492 RtDCpl64.exe 2484 Blasthost.exe 2800 RtDCpl64.exe 1916 RtDCpl64.exe 1808 RtDCpl64.exe 1504 Blasthost.exe -
Loads dropped DLL 13 IoCs
pid Process 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 2424 Blasthost.exe 2424 Blasthost.exe 2492 RtDCpl64.exe 2492 RtDCpl64.exe 2492 RtDCpl64.exe 2492 RtDCpl64.exe 1916 RtDCpl64.exe 1916 RtDCpl64.exe 1916 RtDCpl64.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00060000000186c4-49.dat autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2280 set thread context of 2844 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 31 PID 2492 set thread context of 2800 2492 RtDCpl64.exe 39 PID 1916 set thread context of 1808 1916 RtDCpl64.exe 46 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a66c7afdd58fb40f70d029833dbbaf10N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a66c7afdd58fb40f70d029833dbbaf10N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1760 schtasks.exe 2848 schtasks.exe 1844 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2280 wrote to memory of 2424 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 29 PID 2280 wrote to memory of 2424 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 29 PID 2280 wrote to memory of 2424 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 29 PID 2280 wrote to memory of 2424 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 29 PID 2424 wrote to memory of 2240 2424 Blasthost.exe 30 PID 2424 wrote to memory of 2240 2424 Blasthost.exe 30 PID 2424 wrote to memory of 2240 2424 Blasthost.exe 30 PID 2424 wrote to memory of 2240 2424 Blasthost.exe 30 PID 2280 wrote to memory of 2844 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 31 PID 2280 wrote to memory of 2844 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 31 PID 2280 wrote to memory of 2844 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 31 PID 2280 wrote to memory of 2844 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 31 PID 2280 wrote to memory of 2844 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 31 PID 2280 wrote to memory of 2844 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 31 PID 2280 wrote to memory of 2848 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 32 PID 2280 wrote to memory of 2848 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 32 PID 2280 wrote to memory of 2848 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 32 PID 2280 wrote to memory of 2848 2280 a66c7afdd58fb40f70d029833dbbaf10N.exe 32 PID 2844 wrote to memory of 2724 2844 a66c7afdd58fb40f70d029833dbbaf10N.exe 34 PID 2844 wrote to memory of 2724 2844 a66c7afdd58fb40f70d029833dbbaf10N.exe 34 PID 2844 wrote to memory of 2724 2844 a66c7afdd58fb40f70d029833dbbaf10N.exe 34 PID 2844 wrote to memory of 2724 2844 a66c7afdd58fb40f70d029833dbbaf10N.exe 34 PID 2844 wrote to memory of 2724 2844 a66c7afdd58fb40f70d029833dbbaf10N.exe 34 PID 2844 wrote to memory of 2724 2844 a66c7afdd58fb40f70d029833dbbaf10N.exe 34 PID 2948 wrote to memory of 2492 2948 taskeng.exe 37 PID 2948 wrote to memory of 2492 2948 taskeng.exe 37 PID 2948 wrote to memory of 2492 2948 taskeng.exe 37 PID 2948 wrote to memory of 2492 2948 taskeng.exe 37 PID 2492 wrote to memory of 2484 2492 RtDCpl64.exe 38 PID 2492 wrote to memory of 2484 2492 RtDCpl64.exe 38 PID 2492 wrote to memory of 2484 2492 RtDCpl64.exe 38 PID 2492 wrote to memory of 2484 2492 RtDCpl64.exe 38 PID 2492 wrote to memory of 2800 2492 RtDCpl64.exe 39 PID 2492 wrote to memory of 2800 2492 RtDCpl64.exe 39 PID 2492 wrote to memory of 2800 2492 RtDCpl64.exe 39 PID 2492 wrote to memory of 2800 2492 RtDCpl64.exe 39 PID 2492 wrote to memory of 2800 2492 RtDCpl64.exe 39 PID 2492 wrote to memory of 2800 2492 RtDCpl64.exe 39 PID 2492 wrote to memory of 1844 2492 RtDCpl64.exe 40 PID 2492 wrote to memory of 1844 2492 RtDCpl64.exe 40 PID 2492 wrote to memory of 1844 2492 RtDCpl64.exe 40 PID 2492 wrote to memory of 1844 2492 RtDCpl64.exe 40 PID 2800 wrote to memory of 1664 2800 RtDCpl64.exe 41 PID 2800 wrote to memory of 1664 2800 RtDCpl64.exe 41 PID 2800 wrote to memory of 1664 2800 RtDCpl64.exe 41 PID 2800 wrote to memory of 1664 2800 RtDCpl64.exe 41 PID 2800 wrote to memory of 1664 2800 RtDCpl64.exe 41 PID 2800 wrote to memory of 1664 2800 RtDCpl64.exe 41 PID 2948 wrote to memory of 1916 2948 taskeng.exe 44 PID 2948 wrote to memory of 1916 2948 taskeng.exe 44 PID 2948 wrote to memory of 1916 2948 taskeng.exe 44 PID 2948 wrote to memory of 1916 2948 taskeng.exe 44 PID 1916 wrote to memory of 1504 1916 RtDCpl64.exe 45 PID 1916 wrote to memory of 1504 1916 RtDCpl64.exe 45 PID 1916 wrote to memory of 1504 1916 RtDCpl64.exe 45 PID 1916 wrote to memory of 1504 1916 RtDCpl64.exe 45 PID 1916 wrote to memory of 1808 1916 RtDCpl64.exe 46 PID 1916 wrote to memory of 1808 1916 RtDCpl64.exe 46 PID 1916 wrote to memory of 1808 1916 RtDCpl64.exe 46 PID 1916 wrote to memory of 1808 1916 RtDCpl64.exe 46 PID 1916 wrote to memory of 1808 1916 RtDCpl64.exe 46 PID 1916 wrote to memory of 1808 1916 RtDCpl64.exe 46 PID 1916 wrote to memory of 1760 1916 RtDCpl64.exe 47 PID 1916 wrote to memory of 1760 1916 RtDCpl64.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\a66c7afdd58fb40f70d029833dbbaf10N.exe"C:\Users\Admin\AppData\Local\Temp\a66c7afdd58fb40f70d029833dbbaf10N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2424 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2240
-
-
-
C:\Users\Admin\AppData\Local\Temp\a66c7afdd58fb40f70d029833dbbaf10N.exe"C:\Users\Admin\AppData\Local\Temp\a66c7afdd58fb40f70d029833dbbaf10N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2844 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2724
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2848
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {47BAD324-6BD6-4B95-9014-31BD1D824E55} S-1-5-21-2257386474-3982792636-3902186748-1000:CTBHAMHL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:2484
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1664
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1844
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1504
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1808 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:944
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1760
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
-
Filesize
1.3MB
MD58f51e4be4f5a5a9477977ef4976bef5a
SHA17ff6312a91b4d76a6855b693fd7d66969174afd6
SHA2565f28880ad55015d89d05bbaa2a6cbc787172e5a3268bffbca70c1b903a341ed2
SHA512796e92c1c94b30944a9d38b473b0c8b16ae85368bcf2d0e41f4ef22cdbcc3a81a94520c0b467f0548fd1c91f03b709032eb2eb593912d8f9c39a42bf8af684d8