Analysis
-
max time kernel
120s -
max time network
18s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
06-09-2024 21:35
Behavioral task
behavioral1
Sample
843f5bd331eb9bec6f191b3c398c1750N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
843f5bd331eb9bec6f191b3c398c1750N.exe
Resource
win10v2004-20240802-en
General
-
Target
843f5bd331eb9bec6f191b3c398c1750N.exe
-
Size
1.3MB
-
MD5
843f5bd331eb9bec6f191b3c398c1750
-
SHA1
9c98e56bbaebc2807ee79229cc5413184227509b
-
SHA256
4207d0f6cd53105d4c407235a6dc96843adf25df3de766963afbbed800da3ce9
-
SHA512
c5d4275b5b61f42fad1dc14d55c7189da9bac052c8e2377f8b3672971353fa3bff2df1c9129c98dca3b76cdde0277559c189f74dc4d2f92412eaf5e66ac394ff
-
SSDEEP
24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWY3:8u0c++OCvkGs9Fa+rd1f26RaY3
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Blasthost.exe netwire behavioral1/memory/2272-23-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2096-44-0x0000000000400000-0x000000000042C000-memory.dmp netwire C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe netwire behavioral1/memory/2180-82-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2096-85-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2668-37-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2668-27-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2884-66-0x00000000000D0000-0x00000000000ED000-memory.dmp warzonerat behavioral1/memory/2884-74-0x00000000000D0000-0x00000000000ED000-memory.dmp warzonerat -
Executes dropped EXE 8 IoCs
Processes:
Blasthost.exeHost.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeBlasthost.exeRtDCpl64.exepid process 2272 Blasthost.exe 2096 Host.exe 2592 RtDCpl64.exe 2180 Blasthost.exe 2884 RtDCpl64.exe 2288 RtDCpl64.exe 2352 Blasthost.exe 2376 RtDCpl64.exe -
Loads dropped DLL 13 IoCs
Processes:
843f5bd331eb9bec6f191b3c398c1750N.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exepid process 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 2272 Blasthost.exe 2272 Blasthost.exe 2592 RtDCpl64.exe 2592 RtDCpl64.exe 2592 RtDCpl64.exe 2592 RtDCpl64.exe 2288 RtDCpl64.exe 2288 RtDCpl64.exe 2288 RtDCpl64.exe -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
843f5bd331eb9bec6f191b3c398c1750N.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 1756 set thread context of 2668 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 843f5bd331eb9bec6f191b3c398c1750N.exe PID 2592 set thread context of 2884 2592 RtDCpl64.exe RtDCpl64.exe PID 2288 set thread context of 2376 2288 RtDCpl64.exe RtDCpl64.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 13 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
schtasks.exeRtDCpl64.exe843f5bd331eb9bec6f191b3c398c1750N.exe843f5bd331eb9bec6f191b3c398c1750N.execmd.execmd.exeschtasks.exeBlasthost.exeRtDCpl64.exeRtDCpl64.exeschtasks.exeRtDCpl64.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843f5bd331eb9bec6f191b3c398c1750N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 843f5bd331eb9bec6f191b3c398c1750N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 1752 schtasks.exe 2392 schtasks.exe 2600 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
843f5bd331eb9bec6f191b3c398c1750N.exeBlasthost.exe843f5bd331eb9bec6f191b3c398c1750N.exetaskeng.exeRtDCpl64.exeRtDCpl64.exeRtDCpl64.exedescription pid process target process PID 1756 wrote to memory of 2272 1756 843f5bd331eb9bec6f191b3c398c1750N.exe Blasthost.exe PID 1756 wrote to memory of 2272 1756 843f5bd331eb9bec6f191b3c398c1750N.exe Blasthost.exe PID 1756 wrote to memory of 2272 1756 843f5bd331eb9bec6f191b3c398c1750N.exe Blasthost.exe PID 1756 wrote to memory of 2272 1756 843f5bd331eb9bec6f191b3c398c1750N.exe Blasthost.exe PID 2272 wrote to memory of 2096 2272 Blasthost.exe Host.exe PID 2272 wrote to memory of 2096 2272 Blasthost.exe Host.exe PID 2272 wrote to memory of 2096 2272 Blasthost.exe Host.exe PID 2272 wrote to memory of 2096 2272 Blasthost.exe Host.exe PID 1756 wrote to memory of 2668 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 843f5bd331eb9bec6f191b3c398c1750N.exe PID 1756 wrote to memory of 2668 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 843f5bd331eb9bec6f191b3c398c1750N.exe PID 1756 wrote to memory of 2668 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 843f5bd331eb9bec6f191b3c398c1750N.exe PID 1756 wrote to memory of 2668 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 843f5bd331eb9bec6f191b3c398c1750N.exe PID 1756 wrote to memory of 2668 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 843f5bd331eb9bec6f191b3c398c1750N.exe PID 1756 wrote to memory of 2668 1756 843f5bd331eb9bec6f191b3c398c1750N.exe 843f5bd331eb9bec6f191b3c398c1750N.exe PID 2668 wrote to memory of 2972 2668 843f5bd331eb9bec6f191b3c398c1750N.exe cmd.exe PID 2668 wrote to memory of 2972 2668 843f5bd331eb9bec6f191b3c398c1750N.exe cmd.exe PID 2668 wrote to memory of 2972 2668 843f5bd331eb9bec6f191b3c398c1750N.exe cmd.exe PID 2668 wrote to memory of 2972 2668 843f5bd331eb9bec6f191b3c398c1750N.exe cmd.exe PID 1756 wrote to memory of 2392 1756 843f5bd331eb9bec6f191b3c398c1750N.exe schtasks.exe PID 1756 wrote to memory of 2392 1756 843f5bd331eb9bec6f191b3c398c1750N.exe schtasks.exe PID 1756 wrote to memory of 2392 1756 843f5bd331eb9bec6f191b3c398c1750N.exe schtasks.exe PID 1756 wrote to memory of 2392 1756 843f5bd331eb9bec6f191b3c398c1750N.exe schtasks.exe PID 2668 wrote to memory of 2972 2668 843f5bd331eb9bec6f191b3c398c1750N.exe cmd.exe PID 2668 wrote to memory of 2972 2668 843f5bd331eb9bec6f191b3c398c1750N.exe cmd.exe PID 2544 wrote to memory of 2592 2544 taskeng.exe RtDCpl64.exe PID 2544 wrote to memory of 2592 2544 taskeng.exe RtDCpl64.exe PID 2544 wrote to memory of 2592 2544 taskeng.exe RtDCpl64.exe PID 2544 wrote to memory of 2592 2544 taskeng.exe RtDCpl64.exe PID 2592 wrote to memory of 2180 2592 RtDCpl64.exe Blasthost.exe PID 2592 wrote to memory of 2180 2592 RtDCpl64.exe Blasthost.exe PID 2592 wrote to memory of 2180 2592 RtDCpl64.exe Blasthost.exe PID 2592 wrote to memory of 2180 2592 RtDCpl64.exe Blasthost.exe PID 2592 wrote to memory of 2884 2592 RtDCpl64.exe RtDCpl64.exe PID 2592 wrote to memory of 2884 2592 RtDCpl64.exe RtDCpl64.exe PID 2592 wrote to memory of 2884 2592 RtDCpl64.exe RtDCpl64.exe PID 2592 wrote to memory of 2884 2592 RtDCpl64.exe RtDCpl64.exe PID 2592 wrote to memory of 2884 2592 RtDCpl64.exe RtDCpl64.exe PID 2592 wrote to memory of 2884 2592 RtDCpl64.exe RtDCpl64.exe PID 2884 wrote to memory of 2512 2884 RtDCpl64.exe cmd.exe PID 2884 wrote to memory of 2512 2884 RtDCpl64.exe cmd.exe PID 2884 wrote to memory of 2512 2884 RtDCpl64.exe cmd.exe PID 2884 wrote to memory of 2512 2884 RtDCpl64.exe cmd.exe PID 2592 wrote to memory of 2600 2592 RtDCpl64.exe schtasks.exe PID 2592 wrote to memory of 2600 2592 RtDCpl64.exe schtasks.exe PID 2592 wrote to memory of 2600 2592 RtDCpl64.exe schtasks.exe PID 2592 wrote to memory of 2600 2592 RtDCpl64.exe schtasks.exe PID 2884 wrote to memory of 2512 2884 RtDCpl64.exe cmd.exe PID 2884 wrote to memory of 2512 2884 RtDCpl64.exe cmd.exe PID 2544 wrote to memory of 2288 2544 taskeng.exe RtDCpl64.exe PID 2544 wrote to memory of 2288 2544 taskeng.exe RtDCpl64.exe PID 2544 wrote to memory of 2288 2544 taskeng.exe RtDCpl64.exe PID 2544 wrote to memory of 2288 2544 taskeng.exe RtDCpl64.exe PID 2288 wrote to memory of 2352 2288 RtDCpl64.exe Blasthost.exe PID 2288 wrote to memory of 2352 2288 RtDCpl64.exe Blasthost.exe PID 2288 wrote to memory of 2352 2288 RtDCpl64.exe Blasthost.exe PID 2288 wrote to memory of 2352 2288 RtDCpl64.exe Blasthost.exe PID 2288 wrote to memory of 2376 2288 RtDCpl64.exe RtDCpl64.exe PID 2288 wrote to memory of 2376 2288 RtDCpl64.exe RtDCpl64.exe PID 2288 wrote to memory of 2376 2288 RtDCpl64.exe RtDCpl64.exe PID 2288 wrote to memory of 2376 2288 RtDCpl64.exe RtDCpl64.exe PID 2288 wrote to memory of 2376 2288 RtDCpl64.exe RtDCpl64.exe PID 2288 wrote to memory of 2376 2288 RtDCpl64.exe RtDCpl64.exe PID 2288 wrote to memory of 1752 2288 RtDCpl64.exe schtasks.exe PID 2288 wrote to memory of 1752 2288 RtDCpl64.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\843f5bd331eb9bec6f191b3c398c1750N.exe"C:\Users\Admin\AppData\Local\Temp\843f5bd331eb9bec6f191b3c398c1750N.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2096 -
C:\Users\Admin\AppData\Local\Temp\843f5bd331eb9bec6f191b3c398c1750N.exe"C:\Users\Admin\AppData\Local\Temp\843f5bd331eb9bec6f191b3c398c1750N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2972 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2392
-
C:\Windows\system32\taskeng.exetaskeng.exe {7FACAD0D-3383-470B-A59A-F43D9666D1E3} S-1-5-21-457978338-2990298471-2379561640-1000:WOUOSVRD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:2180 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2512 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2600 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:2352 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2376 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:588 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
-
Filesize
1.3MB
MD5cfc55f1b2bb723abb126bc95ee51e347
SHA1ff1164b1d883e3fd10f4eaa40adfda9bc7b0527b
SHA256ad0f47c55871b20f8ecabc0b9aa0055408450ca30df469611598b6e27fa549c7
SHA512372a262f3fd328cfb1dc98e1e1d43ca0dfbebacebb8de58d5e0a439c0eb69ed4824900779424cd3b430e9beffc6db66e169dbc46449015d5240790041742e968