Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
11-12-2024 03:39
Behavioral task
behavioral1
Sample
e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402.xls
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402.xls
Resource
win10v2004-20241007-en
General
-
Target
e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402.xls
-
Size
198KB
-
MD5
98136ffd902b60b1107c02cb94fc90e2
-
SHA1
ae410c8c5d57fa37b74ff283768bd68c48dd46ae
-
SHA256
e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402
-
SHA512
0ec2eb997c474c19d4ddedbae60552d2b71ce1b1c5780f35e6bafa089bf6a75e8fd1e8bf936ed65f21426274cffad36ce7ffba21ed6dda15b585b20b4e69f650
-
SSDEEP
6144:IxEtjPOtioVjDGUU1qfDlavx+W2QnAo+Ly9ckwDwPq5XlsqbwxNNip:/+VkGUqLsqIi
Malware Config
Extracted
warzonerat
dns.stipamana.com:5219
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral2/memory/4880-92-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4880-96-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4636-105-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 1920 DCNXKNLRS.exe 4880 DCNXKNLRS.exe 2896 DCNXKNLRS.exe 3448 images.exe 4636 images.exe 2084 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" DCNXKNLRS.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1920 set thread context of 4880 1920 DCNXKNLRS.exe 88 PID 1920 set thread context of 2896 1920 DCNXKNLRS.exe 89 PID 3448 set thread context of 4636 3448 images.exe 91 PID 3448 set thread context of 2084 3448 images.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNXKNLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNXKNLRS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language DCNXKNLRS.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1868 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1920 DCNXKNLRS.exe Token: SeDebugPrivilege 3448 images.exe -
Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE 1868 EXCEL.EXE -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1868 wrote to memory of 1920 1868 EXCEL.EXE 86 PID 1868 wrote to memory of 1920 1868 EXCEL.EXE 86 PID 1868 wrote to memory of 1920 1868 EXCEL.EXE 86 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 4880 1920 DCNXKNLRS.exe 88 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 1920 wrote to memory of 2896 1920 DCNXKNLRS.exe 89 PID 4880 wrote to memory of 3448 4880 DCNXKNLRS.exe 90 PID 4880 wrote to memory of 3448 4880 DCNXKNLRS.exe 90 PID 4880 wrote to memory of 3448 4880 DCNXKNLRS.exe 90 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 4636 3448 images.exe 91 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92 PID 3448 wrote to memory of 2084 3448 images.exe 92
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\e569298451bd12f37a4c93fb610b254f6237ae89eb3f573427ace46daedd1402.xls"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3448 -
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4636
-
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\DCNXKNLRS.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2896
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\b8ab77100df80ab2.customDestinations-ms
Filesize1KB
MD573dd70acac4d24958bdc70a07c95026e
SHA1b0f420506a5ca4fbc3042c9251509e15630cd6b6
SHA256c948786e30d27d2a12ea846453ace03e4c9b2ca1d5c9154d2d50f47de99cb693
SHA5120c69be81eea12c2681a63d8f989aef48c31456cfb1f882922327b0be54832def1cd135d8b937b90f5698e00e57bd4398a5ae469678ba3fdcc416e1da412d6c27
-
Filesize
276KB
MD5fa5016fc7fd8afb70576f945e7a467a6
SHA1e2fa696d357eda0dcc5fcee766969e5f773443ff
SHA2568711c0444e0e2869118f577b3e28776c75d0845691bac42cb92005cc97c62b8a
SHA512a0174759a66404f47a9b0ba57e38ea5b51c4155f1420908a57a17a90bae9970040feebb16c5b2e2c649eae67b38cfc920df0fdec1f5252fb8be21974b67d3d67