Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
30-10-2024 11:21
Static task
static1
Behavioral task
behavioral1
Sample
8ee60423bc1f9d704f96b7806b39819a.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
8ee60423bc1f9d704f96b7806b39819a.exe
Resource
win10v2004-20241007-en
General
-
Target
8ee60423bc1f9d704f96b7806b39819a.exe
-
Size
322KB
-
MD5
909737a0a11765901cdce436737ac172
-
SHA1
00d77473c837e0ed2887d6285a6c3c9e47ec83c8
-
SHA256
39cd390039e7ad850abd64cfc0b387c77470153c09d35108cf96a893185804a2
-
SHA512
e0989e9178201f126cc600b2d64c3609ff58f7ee3ab55f177fd7301f32cf13322afe7fdbe7334c52892ffc4f5b193fb38d841371c196ac44341bd54211dab2a2
-
SSDEEP
6144:+vMt6V/hdmkcyvAIFtUx2yTF5vdzfaiWKBilS70e8mZC9TbUcuJJCoED:EMtehrcyvAI8MyT3lfjyS70e84QEO1D
Malware Config
Extracted
warzonerat
tobi12345.hopto.org:50501
Signatures
-
Bazaloader family
-
Detects BazaLoader malware 2 IoCs
BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.
resource yara_rule behavioral1/memory/8088-1948-0x0000000000400000-0x000000000055E000-memory.dmp BazaLoader behavioral1/memory/8088-1964-0x0000000000400000-0x000000000055E000-memory.dmp BazaLoader -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 2 IoCs
resource yara_rule behavioral1/memory/8088-1948-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral1/memory/8088-1964-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat 8ee60423bc1f9d704f96b7806b39819a.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start 8ee60423bc1f9d704f96b7806b39819a.exe -
Executes dropped EXE 2 IoCs
pid Process 2324 win32.exe 8784 win32.exe -
Loads dropped DLL 2 IoCs
pid Process 8088 8ee60423bc1f9d704f96b7806b39819a.exe 2324 win32.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2420 set thread context of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2324 set thread context of 8784 2324 win32.exe 36 -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ee60423bc1f9d704f96b7806b39819a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 8ee60423bc1f9d704f96b7806b39819a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language win32.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\ProgramData:ApplicationData 8ee60423bc1f9d704f96b7806b39819a.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2420 8ee60423bc1f9d704f96b7806b39819a.exe 2420 8ee60423bc1f9d704f96b7806b39819a.exe 2420 8ee60423bc1f9d704f96b7806b39819a.exe 2420 8ee60423bc1f9d704f96b7806b39819a.exe 2420 8ee60423bc1f9d704f96b7806b39819a.exe 2324 win32.exe 2324 win32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2420 8ee60423bc1f9d704f96b7806b39819a.exe Token: SeDebugPrivilege 2324 win32.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 2420 wrote to memory of 8088 2420 8ee60423bc1f9d704f96b7806b39819a.exe 31 PID 8088 wrote to memory of 888 8088 8ee60423bc1f9d704f96b7806b39819a.exe 32 PID 8088 wrote to memory of 888 8088 8ee60423bc1f9d704f96b7806b39819a.exe 32 PID 8088 wrote to memory of 888 8088 8ee60423bc1f9d704f96b7806b39819a.exe 32 PID 8088 wrote to memory of 888 8088 8ee60423bc1f9d704f96b7806b39819a.exe 32 PID 8088 wrote to memory of 2324 8088 8ee60423bc1f9d704f96b7806b39819a.exe 33 PID 8088 wrote to memory of 2324 8088 8ee60423bc1f9d704f96b7806b39819a.exe 33 PID 8088 wrote to memory of 2324 8088 8ee60423bc1f9d704f96b7806b39819a.exe 33 PID 8088 wrote to memory of 2324 8088 8ee60423bc1f9d704f96b7806b39819a.exe 33 PID 888 wrote to memory of 1712 888 cmd.exe 35 PID 888 wrote to memory of 1712 888 cmd.exe 35 PID 888 wrote to memory of 1712 888 cmd.exe 35 PID 888 wrote to memory of 1712 888 cmd.exe 35 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 2324 wrote to memory of 8784 2324 win32.exe 36 PID 8784 wrote to memory of 8892 8784 win32.exe 37 PID 8784 wrote to memory of 8892 8784 win32.exe 37 PID 8784 wrote to memory of 8892 8784 win32.exe 37 PID 8784 wrote to memory of 8892 8784 win32.exe 37 PID 8784 wrote to memory of 8892 8784 win32.exe 37 PID 8784 wrote to memory of 8892 8784 win32.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ee60423bc1f9d704f96b7806b39819a.exe"C:\Users\Admin\AppData\Local\Temp\8ee60423bc1f9d704f96b7806b39819a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Users\Admin\AppData\Local\Temp\8ee60423bc1f9d704f96b7806b39819a.exeC:\Users\Admin\AppData\Local\Temp\8ee60423bc1f9d704f96b7806b39819a.exe2⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:8088 -
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:888 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\win32.exe"4⤵
- System Location Discovery: System Language Discovery
PID:1712
-
-
-
C:\ProgramData\win32.exe"C:\ProgramData\win32.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\win32.exeC:\Users\Admin\AppData\Local\Temp\win32.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8784 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"5⤵
- System Location Discovery: System Language Discovery
PID:8892
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
322KB
MD5909737a0a11765901cdce436737ac172
SHA100d77473c837e0ed2887d6285a6c3c9e47ec83c8
SHA25639cd390039e7ad850abd64cfc0b387c77470153c09d35108cf96a893185804a2
SHA512e0989e9178201f126cc600b2d64c3609ff58f7ee3ab55f177fd7301f32cf13322afe7fdbe7334c52892ffc4f5b193fb38d841371c196ac44341bd54211dab2a2