Analysis

  • max time kernel
    150s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    28-10-2024 05:40

General

  • Target

    dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe

  • Size

    8.2MB

  • MD5

    f3dd3a2b20e6be24171a37f548221c8f

  • SHA1

    1b405add2b15b47be75aab4e7d2dc60e487d54b6

  • SHA256

    dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76

  • SHA512

    04eb816ec4104efd65995f8f4051767fcee142bba12ce6249d7eb01c4bd99b473a4f9ca9615284256354a97fa69e0b1f4631cface91c172abb3f625acff994b2

  • SSDEEP

    49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecz:V8e8e8f8e8e8a

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 3 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

  • ASPack v2.12-2.42 3 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 13 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 5 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 8 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 15 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe
    "C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2452
    • C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe
      "C:\Users\Admin\AppData\Local\Temp\dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76.exe"
      2⤵
      • Loads dropped DLL
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2676
      • \??\c:\windows\system\explorer.exe
        c:\windows\system\explorer.exe
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:1900
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          4⤵
          • Modifies WinLogon for persistence
          • Modifies visiblity of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:620
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            5⤵
            • Executes dropped EXE
            • Adds Run key to start application
            • Suspicious use of SetThreadContext
            • System Location Discovery: System Language Discovery
            PID:2520
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              6⤵
              • Executes dropped EXE
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:1588
              • \??\c:\windows\system\svchost.exe
                c:\windows\system\svchost.exe
                7⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                PID:3024
            • C:\Windows\SysWOW64\diskperf.exe
              "C:\Windows\SysWOW64\diskperf.exe"
              6⤵
                PID:2508
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2260
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2260 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2236
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2440
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1576
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:1104
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1104 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:900
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2420
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:920
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2288
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:1020
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2384
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2384 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2804
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:2668
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 2668 -s 36
                6⤵
                • Loads dropped DLL
                • Program crash
                PID:2696
            • \??\c:\windows\system\spoolsv.exe
              c:\windows\system\spoolsv.exe SE
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:1752
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1752 -s 36
                6⤵
                • Program crash
                PID:2828
          • C:\Windows\SysWOW64\diskperf.exe
            "C:\Windows\SysWOW64\diskperf.exe"
            4⤵
              PID:1560
        • C:\Windows\SysWOW64\diskperf.exe
          "C:\Windows\SysWOW64\diskperf.exe"
          2⤵
            PID:1252

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe

          Filesize

          8.2MB

          MD5

          f3dd3a2b20e6be24171a37f548221c8f

          SHA1

          1b405add2b15b47be75aab4e7d2dc60e487d54b6

          SHA256

          dbe529a5be5b147655f78d2151bf32582b093e9f8b23a6e97d75b305411dbb76

          SHA512

          04eb816ec4104efd65995f8f4051767fcee142bba12ce6249d7eb01c4bd99b473a4f9ca9615284256354a97fa69e0b1f4631cface91c172abb3f625acff994b2

        • C:\Windows\system\explorer.exe

          Filesize

          8.2MB

          MD5

          06371de74390351f1f7c163be53c52b0

          SHA1

          3a07ab1bb45b095ce21321481686a77f5a139b01

          SHA256

          d70f4667d204662b4e679dfbf731d3d6de1c4fd6b9e637e4f189580a1086f03d

          SHA512

          d19e4202339c75aec0054abbc3711fc06c0f5b5f008789fe07134427e4a27f202995340b2df152184a027f2ca791b485065d17e2c76f5324da45ee2d0707e842

        • \Windows\system\spoolsv.exe

          Filesize

          8.2MB

          MD5

          d8d3f8f213f434f3eed08caf3b7ed707

          SHA1

          7a2737005c41e31aaedb8c36d3a158f40745e160

          SHA256

          4c7053ef0e174bed37e619523bb8158aee7618899209b6ac1799382042c48c7f

          SHA512

          c063c3d675a92fe4199ca187e6314392e7ede68908e78c039a6cf922a5c7990cafe6975b39473eff5a86707d0d64c0cda52c67894693ec322fd85682bb25a646

        • memory/620-141-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-151-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-152-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-150-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-140-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/620-132-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-114-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-99-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-189-0x00000000032B0000-0x00000000033C4000-memory.dmp

          Filesize

          1.1MB

        • memory/620-263-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1252-33-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1252-29-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1252-36-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1252-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1252-40-0x0000000000400000-0x0000000000412000-memory.dmp

          Filesize

          72KB

        • memory/1560-82-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

          Filesize

          4KB

        • memory/1588-247-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1588-259-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/1588-254-0x0000000003270000-0x0000000003384000-memory.dmp

          Filesize

          1.1MB

        • memory/1752-220-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1900-52-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1900-85-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1900-54-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1900-57-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1900-53-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/1900-51-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2260-113-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2260-122-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2288-188-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2440-131-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2452-15-0x0000000003230000-0x0000000003344000-memory.dmp

          Filesize

          1.1MB

        • memory/2452-39-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2452-0-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2452-6-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/2452-2-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2452-1-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2452-3-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

        • memory/2452-4-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2520-100-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2520-142-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2520-246-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2520-101-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2520-102-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB

        • memory/2676-12-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2676-27-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2676-10-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2676-22-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2676-14-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/2676-56-0x0000000000400000-0x000000000043E000-memory.dmp

          Filesize

          248KB

        • memory/3024-262-0x0000000000400000-0x0000000000514000-memory.dmp

          Filesize

          1.1MB