Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11-12-2024 03:08
Behavioral task
behavioral1
Sample
a93f870ec5baff88edb4a49b7e1166c6b604c152ab6a49b232ddfa0eaa371886.xls
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
a93f870ec5baff88edb4a49b7e1166c6b604c152ab6a49b232ddfa0eaa371886.xls
Resource
win10v2004-20241007-en
General
-
Target
a93f870ec5baff88edb4a49b7e1166c6b604c152ab6a49b232ddfa0eaa371886.xls
-
Size
69KB
-
MD5
9c500aed213cf9693c7e93a94e4c4b12
-
SHA1
955c61d7f667fcc01780be2124eace8988f423a4
-
SHA256
a93f870ec5baff88edb4a49b7e1166c6b604c152ab6a49b232ddfa0eaa371886
-
SHA512
62dacbd2d51d5d6b20c83914d2c3964161fa9b65a6318998f5d8392bfcc618f31299d401fb8de010402a45c59682022be8d636f559aa293c28900da86e8ff87f
-
SSDEEP
1536:cKxEtjPOtioVjDGUU1qfDlaGGx+cL2QnAzXo4inBGp9tRG52yriu1CVDs:cKxEtjPOtioVjDGUU1qfDlaGGx+cL2Qz
Malware Config
Extracted
warzonerat
dns.stipamana.com:5219
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 3 IoCs
resource yara_rule behavioral1/memory/2572-60-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2572-64-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2964-75-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
pid Process 2752 WOPZNQ.exe 2572 WOPZNQ.exe 2164 WOPZNQ.exe 2004 images.exe 2964 images.exe 300 images.exe -
Loads dropped DLL 5 IoCs
pid Process 2332 EXCEL.EXE 2332 EXCEL.EXE 2332 EXCEL.EXE 2332 EXCEL.EXE 2164 WOPZNQ.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" WOPZNQ.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2752 set thread context of 2572 2752 WOPZNQ.exe 32 PID 2752 set thread context of 2164 2752 WOPZNQ.exe 33 PID 2004 set thread context of 2964 2004 images.exe 35 PID 2004 set thread context of 300 2004 images.exe 36 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOPZNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOPZNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WOPZNQ.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language images.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language EXCEL.EXE -
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2332 EXCEL.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2752 WOPZNQ.exe Token: SeDebugPrivilege 2004 images.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2332 EXCEL.EXE 2332 EXCEL.EXE 2332 EXCEL.EXE 2332 EXCEL.EXE 2332 EXCEL.EXE -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2332 wrote to memory of 2752 2332 EXCEL.EXE 31 PID 2332 wrote to memory of 2752 2332 EXCEL.EXE 31 PID 2332 wrote to memory of 2752 2332 EXCEL.EXE 31 PID 2332 wrote to memory of 2752 2332 EXCEL.EXE 31 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2572 2752 WOPZNQ.exe 32 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2752 wrote to memory of 2164 2752 WOPZNQ.exe 33 PID 2164 wrote to memory of 2004 2164 WOPZNQ.exe 34 PID 2164 wrote to memory of 2004 2164 WOPZNQ.exe 34 PID 2164 wrote to memory of 2004 2164 WOPZNQ.exe 34 PID 2164 wrote to memory of 2004 2164 WOPZNQ.exe 34 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 2964 2004 images.exe 35 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36 PID 2004 wrote to memory of 300 2004 images.exe 36
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\a93f870ec5baff88edb4a49b7e1166c6b604c152ab6a49b232ddfa0eaa371886.xls1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\WOPZNQ.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\WOPZNQ.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\WOPZNQ.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\WOPZNQ.exe3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2572
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\WOPZNQ.exeC:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\WOPZNQ.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2164 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2964
-
-
C:\ProgramData\images.exeC:\ProgramData\images.exe5⤵
- Executes dropped EXE
PID:300
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277KB
MD522a231b758870d819a1169a9744a0805
SHA15a175eff3e50d5108f9d859b57c5be276a23ac53
SHA2564fbea9806312eece3dd8523cf6c9509cedda1abe14fdc55bf793606dffe6c053
SHA512447d2ca8eab182c29c380ddf7ba66bbb5c9ad86edd113d0771e3290146c3a187e95e4931f1ef2b89b2bddd79f42813ea8f47ef643a0ad93f8643e0ae05815ef7