Analysis

  • max time kernel
    147s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    12-12-2024 21:24

General

  • Target

    d2928a656a545e09d4103532e69b7e98.exe

  • Size

    275KB

  • MD5

    d2928a656a545e09d4103532e69b7e98

  • SHA1

    5caa4825462ad5a83ba8f16b284d8e1365a5c05e

  • SHA256

    aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857

  • SHA512

    7778ea634a514812b6be6c826920d33a1c7bb05e74c1e5758308aa51d83cdb14e8fd083bc84684b8f68a3cf5753b580b8c285bfa3e7fdbd08947ca3670f1d451

  • SSDEEP

    6144:kv5oW4iOVCMftXU6JlD23CibX3cC1krm/rxfPDlS5SSGbVd:O6VXU6bKygcoku3P

Malware Config

Extracted

Family

warzonerat

C2

dns.stipamana.com:5220

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzonerat family
  • Warzone RAT payload 9 IoCs
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 52 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe
    "C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe
      C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe
      2⤵
        PID:2844
      • C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe
        C:\Users\Admin\AppData\Local\Temp\d2928a656a545e09d4103532e69b7e98.exe
        2⤵
        • Loads dropped DLL
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\ProgramData\msimages.exe
          "C:\ProgramData\msimages.exe"
          3⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2952
          • C:\ProgramData\msimages.exe
            C:\ProgramData\msimages.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2812
          • C:\ProgramData\msimages.exe
            C:\ProgramData\msimages.exe
            4⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            PID:2436

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \ProgramData\msimages.exe

      Filesize

      275KB

      MD5

      d2928a656a545e09d4103532e69b7e98

      SHA1

      5caa4825462ad5a83ba8f16b284d8e1365a5c05e

      SHA256

      aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857

      SHA512

      7778ea634a514812b6be6c826920d33a1c7bb05e74c1e5758308aa51d83cdb14e8fd083bc84684b8f68a3cf5753b580b8c285bfa3e7fdbd08947ca3670f1d451

    • memory/2136-1-0x00000000001F0000-0x000000000023A000-memory.dmp

      Filesize

      296KB

    • memory/2136-2-0x00000000002B0000-0x0000000000308000-memory.dmp

      Filesize

      352KB

    • memory/2136-3-0x0000000074640000-0x0000000074D2E000-memory.dmp

      Filesize

      6.9MB

    • memory/2136-0-0x000000007464E000-0x000000007464F000-memory.dmp

      Filesize

      4KB

    • memory/2136-9-0x0000000074640000-0x0000000074D2E000-memory.dmp

      Filesize

      6.9MB

    • memory/2436-31-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2436-29-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2812-23-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2812-32-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2812-28-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2840-5-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2840-16-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2840-7-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2840-8-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/2952-19-0x0000000073D60000-0x000000007444E000-memory.dmp

      Filesize

      6.9MB

    • memory/2952-18-0x0000000001290000-0x00000000012DA000-memory.dmp

      Filesize

      296KB

    • memory/2952-17-0x0000000073D6E000-0x0000000073D6F000-memory.dmp

      Filesize

      4KB

    • memory/2952-30-0x0000000073D60000-0x000000007444E000-memory.dmp

      Filesize

      6.9MB