Analysis

  • max time kernel
    119s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    26-10-2024 14:00

General

  • Target

    be1d80f9db1bdf2aa493d775b0b554dbf3c8baf820318114679a8ca18605544eN.exe

  • Size

    3.9MB

  • MD5

    540352fcd47bd5ef2995dd278b6590b0

  • SHA1

    b63bca3fa7be1f9f2c918422d5cb833687b64d77

  • SHA256

    be1d80f9db1bdf2aa493d775b0b554dbf3c8baf820318114679a8ca18605544e

  • SHA512

    da6bceb97a5621567defd275c4e4bb40826b748f2778941adaffa5827c3ec05930ad101df41c5181f11aa7361757e66aeb98e3a229a650699699e48aa35c59dc

  • SSDEEP

    24576:GIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0GoWQDc:7C0bNechC0bNechC0bNecE

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 58 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 6 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be1d80f9db1bdf2aa493d775b0b554dbf3c8baf820318114679a8ca18605544eN.exe
    "C:\Users\Admin\AppData\Local\Temp\be1d80f9db1bdf2aa493d775b0b554dbf3c8baf820318114679a8ca18605544eN.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\be1d80f9db1bdf2aa493d775b0b554dbf3c8baf820318114679a8ca18605544eN.exe
      "C:\Users\Admin\AppData\Local\Temp\be1d80f9db1bdf2aa493d775b0b554dbf3c8baf820318114679a8ca18605544eN.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2976
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:752
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:2888
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2520
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:288
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 288 -s 36
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2000
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:804
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 804 -s 36
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2332
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:1232
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1232 -s 36
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:1332
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2348
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2348 -s 36
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:1924
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2432
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 2432 -s 36
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:2612
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:1612
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1612 -s 36
              6⤵
              • Loads dropped DLL
              • Program crash
              PID:1876
        • C:\Windows\SysWOW64\diskperf.exe
          "C:\Windows\SysWOW64\diskperf.exe"
          4⤵
            PID:2236
      • C:\Windows\SysWOW64\diskperf.exe
        "C:\Windows\SysWOW64\diskperf.exe"
        2⤵
          PID:2928

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

        Filesize

        3.9MB

        MD5

        540352fcd47bd5ef2995dd278b6590b0

        SHA1

        b63bca3fa7be1f9f2c918422d5cb833687b64d77

        SHA256

        be1d80f9db1bdf2aa493d775b0b554dbf3c8baf820318114679a8ca18605544e

        SHA512

        da6bceb97a5621567defd275c4e4bb40826b748f2778941adaffa5827c3ec05930ad101df41c5181f11aa7361757e66aeb98e3a229a650699699e48aa35c59dc

      • C:\Windows\system\explorer.exe

        Filesize

        3.9MB

        MD5

        f34f6834691e0587e83545b39a18c27d

        SHA1

        5168a62d2f0a33bf7e1ad4d64e5fa9272902d576

        SHA256

        4b9b0921ffdbf1dffbf7233ba6f0e6ce057fe89c94054fde9e454fd7c8f0699b

        SHA512

        67ecee940341c9a8299c964ca124c652f29688ddb11b9e0eddb85773df36fc0fa020ce1a4aee9a60dc8032bfa40ec36bcf604035d3a2ccb4d5e668608625f975

      • \Windows\system\spoolsv.exe

        Filesize

        3.9MB

        MD5

        cbbf20643c5784dedcab6d652dc021ca

        SHA1

        5384c200343696e1d0c1d8a88e1ac295746c07ee

        SHA256

        e7d85fa377f96bce3ea3115cdbd645769584b63aca2c62cf8bf54c21f7ef292a

        SHA512

        e309fdbec9af42c7a21947d6e7757688224131e5186df5fb6399dbcbd13248fb0f962406db7ebfb382510cec44c05cec78b85f6903b00764a68ef60d8a78ce9d

      • memory/288-116-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/288-125-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/752-52-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/752-54-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/752-53-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/752-51-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/752-88-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/1232-157-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/1612-206-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2036-22-0x00000000033A0000-0x00000000034B4000-memory.dmp

        Filesize

        1.1MB

      • memory/2036-0-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2036-34-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2036-6-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

      • memory/2036-4-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2036-3-0x0000000000220000-0x0000000000221000-memory.dmp

        Filesize

        4KB

      • memory/2036-1-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2036-2-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2236-89-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2520-103-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2520-104-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2520-136-0x0000000000400000-0x0000000000514000-memory.dmp

        Filesize

        1.1MB

      • memory/2888-114-0x0000000003270000-0x0000000003384000-memory.dmp

        Filesize

        1.1MB

      • memory/2888-124-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/2888-134-0x0000000003270000-0x0000000003384000-memory.dmp

        Filesize

        1.1MB

      • memory/2888-156-0x0000000003270000-0x0000000003384000-memory.dmp

        Filesize

        1.1MB

      • memory/2888-144-0x0000000003270000-0x0000000003384000-memory.dmp

        Filesize

        1.1MB

      • memory/2888-97-0x0000000003270000-0x0000000003384000-memory.dmp

        Filesize

        1.1MB

      • memory/2888-149-0x0000000003270000-0x0000000003384000-memory.dmp

        Filesize

        1.1MB

      • memory/2888-145-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/2888-133-0x0000000003270000-0x0000000003384000-memory.dmp

        Filesize

        1.1MB

      • memory/2928-30-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2928-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2928-26-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2928-38-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2928-36-0x0000000000400000-0x0000000000412000-memory.dmp

        Filesize

        72KB

      • memory/2976-10-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/2976-35-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/2976-12-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/2976-56-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/2976-24-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB

      • memory/2976-45-0x00000000033C0000-0x00000000034D4000-memory.dmp

        Filesize

        1.1MB

      • memory/2976-14-0x0000000000400000-0x000000000043E000-memory.dmp

        Filesize

        248KB