Analysis
-
max time kernel
147s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
12-12-2024 21:24
Static task
static1
Behavioral task
behavioral1
Sample
d2928a656a545e09d4103532e69b7e98.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
d2928a656a545e09d4103532e69b7e98.exe
Resource
win10v2004-20241007-en
General
-
Target
d2928a656a545e09d4103532e69b7e98.exe
-
Size
275KB
-
MD5
d2928a656a545e09d4103532e69b7e98
-
SHA1
5caa4825462ad5a83ba8f16b284d8e1365a5c05e
-
SHA256
aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857
-
SHA512
7778ea634a514812b6be6c826920d33a1c7bb05e74c1e5758308aa51d83cdb14e8fd083bc84684b8f68a3cf5753b580b8c285bfa3e7fdbd08947ca3670f1d451
-
SSDEEP
6144:kv5oW4iOVCMftXU6JlD23CibX3cC1krm/rxfPDlS5SSGbVd:O6VXU6bKygcoku3P
Malware Config
Extracted
warzonerat
dns.stipamana.com:5220
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 9 IoCs
resource yara_rule behavioral1/memory/2840-5-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-8-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-7-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2840-16-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2812-23-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2436-29-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2812-28-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2436-31-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2812-32-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 3 IoCs
pid Process 2952 msimages.exe 2812 msimages.exe 2436 msimages.exe -
Loads dropped DLL 1 IoCs
pid Process 2840 d2928a656a545e09d4103532e69b7e98.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\msimages = "C:\\ProgramData\\msimages.exe" d2928a656a545e09d4103532e69b7e98.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2136 set thread context of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 set thread context of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2952 set thread context of 2812 2952 msimages.exe 34 PID 2952 set thread context of 2436 2952 msimages.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2928a656a545e09d4103532e69b7e98.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2928a656a545e09d4103532e69b7e98.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msimages.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msimages.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msimages.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2136 d2928a656a545e09d4103532e69b7e98.exe Token: SeDebugPrivilege 2952 msimages.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2844 2136 d2928a656a545e09d4103532e69b7e98.exe 31 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2136 wrote to memory of 2840 2136 d2928a656a545e09d4103532e69b7e98.exe 32 PID 2840 wrote to memory of 2952 2840 d2928a656a545e09d4103532e69b7e98.exe 33 PID 2840 wrote to memory of 2952 2840 d2928a656a545e09d4103532e69b7e98.exe 33 PID 2840 wrote to memory of 2952 2840 d2928a656a545e09d4103532e69b7e98.exe 33 PID 2840 wrote to memory of 2952 2840 d2928a656a545e09d4103532e69b7e98.exe 33 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2812 2952 msimages.exe 34 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35 PID 2952 wrote to memory of 2436 2952 msimages.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe"C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2136 -
C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exeC:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe2⤵PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exeC:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\ProgramData\msimages.exe"C:\ProgramData\msimages.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\ProgramData\msimages.exeC:\ProgramData\msimages.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2812
-
-
C:\ProgramData\msimages.exeC:\ProgramData\msimages.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2436
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275KB
MD5d2928a656a545e09d4103532e69b7e98
SHA15caa4825462ad5a83ba8f16b284d8e1365a5c05e
SHA256aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857
SHA5127778ea634a514812b6be6c826920d33a1c7bb05e74c1e5758308aa51d83cdb14e8fd083bc84684b8f68a3cf5753b580b8c285bfa3e7fdbd08947ca3670f1d451