Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe
Resource
win10v2004-20241007-en
General
-
Target
aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe
-
Size
275KB
-
MD5
d2928a656a545e09d4103532e69b7e98
-
SHA1
5caa4825462ad5a83ba8f16b284d8e1365a5c05e
-
SHA256
aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857
-
SHA512
7778ea634a514812b6be6c826920d33a1c7bb05e74c1e5758308aa51d83cdb14e8fd083bc84684b8f68a3cf5753b580b8c285bfa3e7fdbd08947ca3670f1d451
-
SSDEEP
6144:kv5oW4iOVCMftXU6JlD23CibX3cC1krm/rxfPDlS5SSGbVd:O6VXU6bKygcoku3P
Malware Config
Extracted
warzonerat
dns.stipamana.com:5220
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 7 IoCs
resource yara_rule behavioral2/memory/4972-7-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4972-10-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4972-12-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4972-17-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4952-26-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4952-27-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/4952-29-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 3 IoCs
pid Process 4484 msimages.exe 4952 msimages.exe 4652 msimages.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\msimages = "C:\\ProgramData\\msimages.exe" aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 4868 set thread context of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 set thread context of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4484 set thread context of 4952 4484 msimages.exe 91 PID 4484 set thread context of 4652 4484 msimages.exe 92 -
Program crash 2 IoCs
pid pid_target Process procid_target 2160 1632 WerFault.exe 85 4860 4652 WerFault.exe 92 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msimages.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msimages.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe Token: SeDebugPrivilege 4484 msimages.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1632 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 1632 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 85 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4868 wrote to memory of 4972 4868 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 86 PID 4972 wrote to memory of 4484 4972 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 90 PID 4972 wrote to memory of 4484 4972 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 90 PID 4972 wrote to memory of 4484 4972 aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe 90 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4952 4484 msimages.exe 91 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92 PID 4484 wrote to memory of 4652 4484 msimages.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe"C:\Users\Admin\AppData\Local\Temp\aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Users\Admin\AppData\Local\Temp\aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exeC:\Users\Admin\AppData\Local\Temp\aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe2⤵
- Suspicious use of UnmapMainImage
PID:1632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 123⤵
- Program crash
PID:2160
-
-
-
C:\Users\Admin\AppData\Local\Temp\aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exeC:\Users\Admin\AppData\Local\Temp\aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857.exe2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\ProgramData\msimages.exe"C:\ProgramData\msimages.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4484 -
C:\ProgramData\msimages.exeC:\ProgramData\msimages.exe4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4952
-
-
C:\ProgramData\msimages.exeC:\ProgramData\msimages.exe4⤵
- Executes dropped EXE
PID:4652 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4652 -s 805⤵
- Program crash
PID:4860
-
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1632 -ip 16321⤵PID:3036
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 4652 -ip 46521⤵PID:1644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
275KB
MD5d2928a656a545e09d4103532e69b7e98
SHA15caa4825462ad5a83ba8f16b284d8e1365a5c05e
SHA256aaae2a95d3c2054414d9b4cd55405563c1059ac881d9252ce338ecef1a25f857
SHA5127778ea634a514812b6be6c826920d33a1c7bb05e74c1e5758308aa51d83cdb14e8fd083bc84684b8f68a3cf5753b580b8c285bfa3e7fdbd08947ca3670f1d451