Analysis

  • max time kernel
    146s
  • max time network
    147s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    10-12-2024 18:45

General

  • Target

    file.exe

  • Size

    275KB

  • MD5

    21aea7934aee995629e68e5834695608

  • SHA1

    94e690f33e0f7b8ea8a1c665359836b363cc09a5

  • SHA256

    1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5

  • SHA512

    b25883eecaa34a355047c4c6c0f684298f2803e757ffb3fdc6b097c62283e96b6801cafa3eaab9eb49df79c2abefebcc5d53816b877bd9ce108864785942b0ad

  • SSDEEP

    6144:1b0neHPqlbJjsye59MQwtBakPHyxqZ3I6qGtVmIt2M3FraeLh87knbqbNyd:2neSbJOD5WXuqZ3IxGtPtBZae1M+mM

Malware Config

Extracted

Family

warzonerat

C2

dns.stipamana.com:5219

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 7 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2592
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      C:\Users\Admin\AppData\Local\Temp\file.exe
      2⤵
      • System Location Discovery: System Language Discovery
      PID:1684
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      C:\Users\Admin\AppData\Local\Temp\file.exe
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\ProgramData\images.exe
        "C:\ProgramData\images.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:292
        • C:\ProgramData\images.exe
          C:\ProgramData\images.exe
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          PID:2988
        • C:\ProgramData\images.exe
          C:\ProgramData\images.exe
          4⤵
          • Executes dropped EXE
          PID:2176

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \ProgramData\images.exe

    Filesize

    275KB

    MD5

    21aea7934aee995629e68e5834695608

    SHA1

    94e690f33e0f7b8ea8a1c665359836b363cc09a5

    SHA256

    1f6feae633a783cf6ef08eee6b65049fe5b692c8a743af8967984e2e212a06b5

    SHA512

    b25883eecaa34a355047c4c6c0f684298f2803e757ffb3fdc6b097c62283e96b6801cafa3eaab9eb49df79c2abefebcc5d53816b877bd9ce108864785942b0ad

  • memory/292-21-0x00000000000A0000-0x00000000000EA000-memory.dmp

    Filesize

    296KB

  • memory/1684-13-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/1684-5-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/1684-8-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/1684-10-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/2448-11-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/2448-20-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB

  • memory/2592-3-0x0000000074D30000-0x000000007541E000-memory.dmp

    Filesize

    6.9MB

  • memory/2592-12-0x0000000074D30000-0x000000007541E000-memory.dmp

    Filesize

    6.9MB

  • memory/2592-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

    Filesize

    4KB

  • memory/2592-2-0x00000000009B0000-0x0000000000A08000-memory.dmp

    Filesize

    352KB

  • memory/2592-1-0x0000000000A40000-0x0000000000A8A000-memory.dmp

    Filesize

    296KB

  • memory/2988-28-0x0000000000400000-0x0000000000554000-memory.dmp

    Filesize

    1.3MB