Analysis
-
max time kernel
149s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
17-12-2024 21:51
Behavioral task
behavioral1
Sample
567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe
Resource
win10v2004-20241007-en
General
-
Target
567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe
-
Size
1.4MB
-
MD5
51ec2a6f0c78f260ceb0da7b3e4f4e90
-
SHA1
923d9dabe490d5c33d31f6f6f205c712b41aed53
-
SHA256
567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed
-
SHA512
a5ddaebd8dd0265631494f2332982dcdaf2d5143c6c95e9d41e5ca7370b86bebd40fd94ff3f4eb9e88c339f5c9108c01fd2fdee54467256b30ff3d8ee0ff2789
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYa:Fo0c++OCokGs9Fa+rd1f26RNYa
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 12 IoCs
resource yara_rule behavioral1/memory/2544-0-0x0000000001220000-0x000000000138B000-memory.dmp netwire behavioral1/files/0x00080000000120fd-3.dat netwire behavioral1/memory/2796-24-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/2544-41-0x0000000001220000-0x000000000138B000-memory.dmp netwire behavioral1/memory/2852-47-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/files/0x00060000000193f7-49.dat netwire behavioral1/memory/2072-51-0x0000000000D10000-0x0000000000E7B000-memory.dmp netwire behavioral1/memory/2072-80-0x0000000000D10000-0x0000000000E7B000-memory.dmp netwire behavioral1/memory/2852-86-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/1624-88-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral1/memory/620-115-0x0000000000D10000-0x0000000000E7B000-memory.dmp netwire behavioral1/memory/2464-156-0x0000000000D10000-0x0000000000E7B000-memory.dmp netwire -
Netwire family
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral1/memory/2108-39-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2108-29-0x0000000000080000-0x000000000009D000-memory.dmp warzonerat behavioral1/memory/2276-105-0x00000000000C0000-0x00000000000DD000-memory.dmp warzonerat behavioral1/memory/2276-114-0x00000000000C0000-0x00000000000DD000-memory.dmp warzonerat -
Executes dropped EXE 11 IoCs
pid Process 2796 Blasthost.exe 2852 Host.exe 2072 RtDCpl64.exe 1624 Blasthost.exe 1556 RtDCpl64.exe 620 RtDCpl64.exe 1096 Blasthost.exe 2276 RtDCpl64.exe 2464 RtDCpl64.exe 1388 Blasthost.exe 2188 RtDCpl64.exe -
Loads dropped DLL 16 IoCs
pid Process 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 2796 Blasthost.exe 2796 Blasthost.exe 2072 RtDCpl64.exe 2072 RtDCpl64.exe 2072 RtDCpl64.exe 2072 RtDCpl64.exe 620 RtDCpl64.exe 620 RtDCpl64.exe 620 RtDCpl64.exe 2464 RtDCpl64.exe 2464 RtDCpl64.exe 2464 RtDCpl64.exe -
AutoIT Executable 7 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2544-0-0x0000000001220000-0x000000000138B000-memory.dmp autoit_exe behavioral1/memory/2544-41-0x0000000001220000-0x000000000138B000-memory.dmp autoit_exe behavioral1/files/0x00060000000193f7-49.dat autoit_exe behavioral1/memory/2072-51-0x0000000000D10000-0x0000000000E7B000-memory.dmp autoit_exe behavioral1/memory/2072-80-0x0000000000D10000-0x0000000000E7B000-memory.dmp autoit_exe behavioral1/memory/620-115-0x0000000000D10000-0x0000000000E7B000-memory.dmp autoit_exe behavioral1/memory/2464-156-0x0000000000D10000-0x0000000000E7B000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 2544 set thread context of 2108 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 31 PID 2072 set thread context of 1556 2072 RtDCpl64.exe 39 PID 620 set thread context of 2276 620 RtDCpl64.exe 46 PID 2464 set thread context of 2188 2464 RtDCpl64.exe 53 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 17 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe 2912 schtasks.exe 2496 schtasks.exe 2400 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2544 wrote to memory of 2796 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 29 PID 2544 wrote to memory of 2796 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 29 PID 2544 wrote to memory of 2796 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 29 PID 2544 wrote to memory of 2796 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 29 PID 2796 wrote to memory of 2852 2796 Blasthost.exe 30 PID 2796 wrote to memory of 2852 2796 Blasthost.exe 30 PID 2796 wrote to memory of 2852 2796 Blasthost.exe 30 PID 2796 wrote to memory of 2852 2796 Blasthost.exe 30 PID 2544 wrote to memory of 2108 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 31 PID 2544 wrote to memory of 2108 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 31 PID 2544 wrote to memory of 2108 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 31 PID 2544 wrote to memory of 2108 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 31 PID 2544 wrote to memory of 2108 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 31 PID 2544 wrote to memory of 2108 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 31 PID 2108 wrote to memory of 2836 2108 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 32 PID 2108 wrote to memory of 2836 2108 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 32 PID 2108 wrote to memory of 2836 2108 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 32 PID 2108 wrote to memory of 2836 2108 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 32 PID 2544 wrote to memory of 2912 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 34 PID 2544 wrote to memory of 2912 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 34 PID 2544 wrote to memory of 2912 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 34 PID 2544 wrote to memory of 2912 2544 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 34 PID 2108 wrote to memory of 2836 2108 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 32 PID 2108 wrote to memory of 2836 2108 567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe 32 PID 2576 wrote to memory of 2072 2576 taskeng.exe 37 PID 2576 wrote to memory of 2072 2576 taskeng.exe 37 PID 2576 wrote to memory of 2072 2576 taskeng.exe 37 PID 2576 wrote to memory of 2072 2576 taskeng.exe 37 PID 2072 wrote to memory of 1624 2072 RtDCpl64.exe 38 PID 2072 wrote to memory of 1624 2072 RtDCpl64.exe 38 PID 2072 wrote to memory of 1624 2072 RtDCpl64.exe 38 PID 2072 wrote to memory of 1624 2072 RtDCpl64.exe 38 PID 2072 wrote to memory of 1556 2072 RtDCpl64.exe 39 PID 2072 wrote to memory of 1556 2072 RtDCpl64.exe 39 PID 2072 wrote to memory of 1556 2072 RtDCpl64.exe 39 PID 2072 wrote to memory of 1556 2072 RtDCpl64.exe 39 PID 2072 wrote to memory of 1556 2072 RtDCpl64.exe 39 PID 2072 wrote to memory of 1556 2072 RtDCpl64.exe 39 PID 1556 wrote to memory of 2644 1556 RtDCpl64.exe 40 PID 1556 wrote to memory of 2644 1556 RtDCpl64.exe 40 PID 1556 wrote to memory of 2644 1556 RtDCpl64.exe 40 PID 1556 wrote to memory of 2644 1556 RtDCpl64.exe 40 PID 2072 wrote to memory of 2496 2072 RtDCpl64.exe 42 PID 2072 wrote to memory of 2496 2072 RtDCpl64.exe 42 PID 2072 wrote to memory of 2496 2072 RtDCpl64.exe 42 PID 2072 wrote to memory of 2496 2072 RtDCpl64.exe 42 PID 1556 wrote to memory of 2644 1556 RtDCpl64.exe 40 PID 1556 wrote to memory of 2644 1556 RtDCpl64.exe 40 PID 2576 wrote to memory of 620 2576 taskeng.exe 44 PID 2576 wrote to memory of 620 2576 taskeng.exe 44 PID 2576 wrote to memory of 620 2576 taskeng.exe 44 PID 2576 wrote to memory of 620 2576 taskeng.exe 44 PID 620 wrote to memory of 1096 620 RtDCpl64.exe 45 PID 620 wrote to memory of 1096 620 RtDCpl64.exe 45 PID 620 wrote to memory of 1096 620 RtDCpl64.exe 45 PID 620 wrote to memory of 1096 620 RtDCpl64.exe 45 PID 620 wrote to memory of 2276 620 RtDCpl64.exe 46 PID 620 wrote to memory of 2276 620 RtDCpl64.exe 46 PID 620 wrote to memory of 2276 620 RtDCpl64.exe 46 PID 620 wrote to memory of 2276 620 RtDCpl64.exe 46 PID 620 wrote to memory of 2276 620 RtDCpl64.exe 46 PID 620 wrote to memory of 2276 620 RtDCpl64.exe 46 PID 620 wrote to memory of 2400 620 RtDCpl64.exe 47 PID 620 wrote to memory of 2400 620 RtDCpl64.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe"C:\Users\Admin\AppData\Local\Temp\567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2544 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
PID:2852
-
-
-
C:\Users\Admin\AppData\Local\Temp\567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe"C:\Users\Admin\AppData\Local\Temp\567ceaa988de4ffef7a0f21222be05980a87cba88bbec883bfda5cdb820a77ed.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2836
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2912
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {C858E9C4-FAC9-44B3-8E07-F5D14F29AABF} S-1-5-21-2703099537-420551529-3771253338-1000:XECUDNCD\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1624
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2644
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2496
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1096
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2276 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2420
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2400
-
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2464 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"3⤵
- Executes dropped EXE
PID:1388
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2188 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
- System Location Discovery: System Language Discovery
PID:2720
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2736
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.4MB
MD53882b959971a27dcd59f8efb526b0597
SHA170ef6168ef7e5baaea91c86f492ed994335b9b4d
SHA256c1c8332289463d7c3b4a1cbaf7072165ed0fd6842ae15478899127f5d51f84ce
SHA5128dd5fe0bb89f6a50fb7d9fee3fc00193b63ee586034a5b4ca8be10445b72f614024e7c683dc194a8d20708dc40549eb96775d69cea77401009afd6f74711b845
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292