Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-01-2025 01:11
Behavioral task
behavioral1
Sample
560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe
Resource
win10v2004-20241007-en
General
-
Target
560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe
-
Size
1.4MB
-
MD5
854a80336030b12385e0e6f8aecaa9fb
-
SHA1
ba3c37e5f5541e0d6906fb0456ed6eb054c713d5
-
SHA256
560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9
-
SHA512
54037c5b4904d1f9f1c01456bc7bbf4e14f324a4e9fd0314e13fad91e2cc8ff02182cb1ae90d0e3a093b27ea7d1df753b4af0aecc5d78f82b532223247fa7880
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYc:Fo0c++OCokGs9Fa+rd1f26RNYc
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 11 IoCs
resource yara_rule behavioral2/memory/2352-0-0x0000000000E60000-0x0000000000FCB000-memory.dmp netwire behavioral2/files/0x000b000000023b70-5.dat netwire behavioral2/memory/4536-12-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/2352-25-0x0000000000E60000-0x0000000000FCB000-memory.dmp netwire behavioral2/memory/2080-28-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/files/0x000a000000023b78-32.dat netwire behavioral2/memory/1544-34-0x00000000008B0000-0x0000000000A1B000-memory.dmp netwire behavioral2/memory/1544-52-0x00000000008B0000-0x0000000000A1B000-memory.dmp netwire behavioral2/memory/1676-57-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/388-78-0x00000000008B0000-0x0000000000A1B000-memory.dmp netwire behavioral2/memory/2968-83-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Netwire family
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/memory/1424-15-0x00000000001E0000-0x00000000001FD000-memory.dmp warzonerat behavioral2/memory/1424-23-0x00000000001E0000-0x00000000001FD000-memory.dmp warzonerat behavioral2/memory/4444-43-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/4444-51-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation RtDCpl64.exe -
Executes dropped EXE 8 IoCs
pid Process 4536 Blasthost.exe 2080 Host.exe 1544 RtDCpl64.exe 1676 Blasthost.exe 4444 RtDCpl64.exe 388 RtDCpl64.exe 2968 Blasthost.exe 716 RtDCpl64.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/2352-0-0x0000000000E60000-0x0000000000FCB000-memory.dmp autoit_exe behavioral2/memory/2352-25-0x0000000000E60000-0x0000000000FCB000-memory.dmp autoit_exe behavioral2/files/0x000a000000023b78-32.dat autoit_exe behavioral2/memory/1544-34-0x00000000008B0000-0x0000000000A1B000-memory.dmp autoit_exe behavioral2/memory/1544-52-0x00000000008B0000-0x0000000000A1B000-memory.dmp autoit_exe behavioral2/memory/388-78-0x00000000008B0000-0x0000000000A1B000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2352 set thread context of 1424 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 86 PID 1544 set thread context of 4444 1544 RtDCpl64.exe 110 PID 388 set thread context of 716 388 RtDCpl64.exe 119 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4208 schtasks.exe 1092 schtasks.exe 2368 schtasks.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 2352 wrote to memory of 4536 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 83 PID 2352 wrote to memory of 4536 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 83 PID 2352 wrote to memory of 4536 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 83 PID 4536 wrote to memory of 2080 4536 Blasthost.exe 85 PID 4536 wrote to memory of 2080 4536 Blasthost.exe 85 PID 4536 wrote to memory of 2080 4536 Blasthost.exe 85 PID 2352 wrote to memory of 1424 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 86 PID 2352 wrote to memory of 1424 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 86 PID 2352 wrote to memory of 1424 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 86 PID 2352 wrote to memory of 1424 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 86 PID 2352 wrote to memory of 1424 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 86 PID 1424 wrote to memory of 536 1424 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 87 PID 1424 wrote to memory of 536 1424 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 87 PID 1424 wrote to memory of 536 1424 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 87 PID 2352 wrote to memory of 4208 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 89 PID 2352 wrote to memory of 4208 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 89 PID 2352 wrote to memory of 4208 2352 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 89 PID 1424 wrote to memory of 536 1424 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 87 PID 1424 wrote to memory of 536 1424 560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe 87 PID 1544 wrote to memory of 1676 1544 RtDCpl64.exe 109 PID 1544 wrote to memory of 1676 1544 RtDCpl64.exe 109 PID 1544 wrote to memory of 1676 1544 RtDCpl64.exe 109 PID 1544 wrote to memory of 4444 1544 RtDCpl64.exe 110 PID 1544 wrote to memory of 4444 1544 RtDCpl64.exe 110 PID 1544 wrote to memory of 4444 1544 RtDCpl64.exe 110 PID 1544 wrote to memory of 4444 1544 RtDCpl64.exe 110 PID 1544 wrote to memory of 4444 1544 RtDCpl64.exe 110 PID 4444 wrote to memory of 3100 4444 RtDCpl64.exe 111 PID 4444 wrote to memory of 3100 4444 RtDCpl64.exe 111 PID 4444 wrote to memory of 3100 4444 RtDCpl64.exe 111 PID 1544 wrote to memory of 1092 1544 RtDCpl64.exe 112 PID 1544 wrote to memory of 1092 1544 RtDCpl64.exe 112 PID 1544 wrote to memory of 1092 1544 RtDCpl64.exe 112 PID 4444 wrote to memory of 3100 4444 RtDCpl64.exe 111 PID 4444 wrote to memory of 3100 4444 RtDCpl64.exe 111 PID 388 wrote to memory of 2968 388 RtDCpl64.exe 118 PID 388 wrote to memory of 2968 388 RtDCpl64.exe 118 PID 388 wrote to memory of 2968 388 RtDCpl64.exe 118 PID 388 wrote to memory of 716 388 RtDCpl64.exe 119 PID 388 wrote to memory of 716 388 RtDCpl64.exe 119 PID 388 wrote to memory of 716 388 RtDCpl64.exe 119 PID 388 wrote to memory of 716 388 RtDCpl64.exe 119 PID 388 wrote to memory of 716 388 RtDCpl64.exe 119 PID 716 wrote to memory of 1660 716 RtDCpl64.exe 120 PID 716 wrote to memory of 1660 716 RtDCpl64.exe 120 PID 716 wrote to memory of 1660 716 RtDCpl64.exe 120 PID 388 wrote to memory of 2368 388 RtDCpl64.exe 121 PID 388 wrote to memory of 2368 388 RtDCpl64.exe 121 PID 388 wrote to memory of 2368 388 RtDCpl64.exe 121 PID 716 wrote to memory of 1660 716 RtDCpl64.exe 120 PID 716 wrote to memory of 1660 716 RtDCpl64.exe 120
Processes
-
C:\Users\Admin\AppData\Local\Temp\560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe"C:\Users\Admin\AppData\Local\Temp\560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2080
-
-
-
C:\Users\Admin\AppData\Local\Temp\560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe"C:\Users\Admin\AppData\Local\Temp\560d9dec66ad3ef9c78092f0526e863bc0b6f96499637c18e38972ce2c276bb9.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:536
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4208
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:1676
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:3100
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1092
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:388 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:2968
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:1660
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2368
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
-
Filesize
1.4MB
MD52dd003d8d42282c43df77b7df83374da
SHA19327cf79e0dd2c5e950a4249668a111e34f9e335
SHA25661e7239131b477b94aadcb63d5490be1774c0d3d65932561f2ca84f5e5086cb8
SHA512caf41ce7df752b5d5a73c107890a54bd2ae094879d8ec438177af5b9da23d02b4a365092814dc391c210a644a00f35107f6162350c8c44d0826ab0f9108b9dd3