Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2025, 12:24
Behavioral task
behavioral1
Sample
2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe
Resource
win10v2004-20241007-en
General
-
Target
2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe
-
Size
1.4MB
-
MD5
353e0cb2ff843172c8163bc6ebc518c0
-
SHA1
2c252f9b23d71d16b50b66a130b52c3675dfeabd
-
SHA256
2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5
-
SHA512
c8a4e6b79efea70723a4fbb44632c392e9f3e44b3fe989027d296641fe75dd0d8ea6f442afb08cbbf15b82b2fd76d65e425d6d4bb0997433ca8271c6b3d0a6a3
-
SSDEEP
24576:ru6J3xO0c+JY5UZ+XCHkGso6Fa720W4njUprvVcC1f2o5RRfgdWYI:Fo0c++OCokGs9Fa+rd1f26RNYI
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Signatures
-
NetWire RAT payload 11 IoCs
resource yara_rule behavioral2/memory/872-0-0x00000000003B0000-0x000000000051B000-memory.dmp netwire behavioral2/files/0x000c000000023b36-5.dat netwire behavioral2/memory/4004-12-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/872-25-0x00000000003B0000-0x000000000051B000-memory.dmp netwire behavioral2/memory/1852-28-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/files/0x000a000000023b97-30.dat netwire behavioral2/memory/3912-31-0x00000000005D0000-0x000000000073B000-memory.dmp netwire behavioral2/memory/3912-49-0x00000000005D0000-0x000000000073B000-memory.dmp netwire behavioral2/memory/3852-54-0x0000000000400000-0x000000000042C000-memory.dmp netwire behavioral2/memory/1708-75-0x00000000005D0000-0x000000000073B000-memory.dmp netwire behavioral2/memory/4260-80-0x0000000000400000-0x000000000042C000-memory.dmp netwire -
Netwire family
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/memory/4300-15-0x00000000014B0000-0x00000000014CD000-memory.dmp warzonerat behavioral2/memory/4300-23-0x00000000014B0000-0x00000000014CD000-memory.dmp warzonerat behavioral2/memory/2012-40-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/2012-48-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation RtDCpl64.exe Key value queried \REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation RtDCpl64.exe -
Executes dropped EXE 8 IoCs
pid Process 4004 Blasthost.exe 1852 Host.exe 3912 RtDCpl64.exe 3852 Blasthost.exe 2012 RtDCpl64.exe 1708 RtDCpl64.exe 4260 Blasthost.exe 2116 RtDCpl64.exe -
AutoIT Executable 6 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/872-0-0x00000000003B0000-0x000000000051B000-memory.dmp autoit_exe behavioral2/memory/872-25-0x00000000003B0000-0x000000000051B000-memory.dmp autoit_exe behavioral2/files/0x000a000000023b97-30.dat autoit_exe behavioral2/memory/3912-31-0x00000000005D0000-0x000000000073B000-memory.dmp autoit_exe behavioral2/memory/3912-49-0x00000000005D0000-0x000000000073B000-memory.dmp autoit_exe behavioral2/memory/1708-75-0x00000000005D0000-0x000000000073B000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 872 set thread context of 4300 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 88 PID 3912 set thread context of 2012 3912 RtDCpl64.exe 108 PID 1708 set thread context of 2116 1708 RtDCpl64.exe 121 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 14 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Blasthost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Host.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RtDCpl64.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 768 schtasks.exe 3736 schtasks.exe 2204 schtasks.exe -
Suspicious use of WriteProcessMemory 51 IoCs
description pid Process procid_target PID 872 wrote to memory of 4004 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 85 PID 872 wrote to memory of 4004 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 85 PID 872 wrote to memory of 4004 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 85 PID 4004 wrote to memory of 1852 4004 Blasthost.exe 87 PID 4004 wrote to memory of 1852 4004 Blasthost.exe 87 PID 4004 wrote to memory of 1852 4004 Blasthost.exe 87 PID 872 wrote to memory of 4300 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 88 PID 872 wrote to memory of 4300 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 88 PID 872 wrote to memory of 4300 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 88 PID 872 wrote to memory of 4300 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 88 PID 872 wrote to memory of 4300 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 88 PID 4300 wrote to memory of 2384 4300 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 89 PID 4300 wrote to memory of 2384 4300 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 89 PID 4300 wrote to memory of 2384 4300 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 89 PID 872 wrote to memory of 768 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 91 PID 872 wrote to memory of 768 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 91 PID 872 wrote to memory of 768 872 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 91 PID 4300 wrote to memory of 2384 4300 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 89 PID 4300 wrote to memory of 2384 4300 2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe 89 PID 3912 wrote to memory of 3852 3912 RtDCpl64.exe 107 PID 3912 wrote to memory of 3852 3912 RtDCpl64.exe 107 PID 3912 wrote to memory of 3852 3912 RtDCpl64.exe 107 PID 3912 wrote to memory of 2012 3912 RtDCpl64.exe 108 PID 3912 wrote to memory of 2012 3912 RtDCpl64.exe 108 PID 3912 wrote to memory of 2012 3912 RtDCpl64.exe 108 PID 3912 wrote to memory of 2012 3912 RtDCpl64.exe 108 PID 3912 wrote to memory of 2012 3912 RtDCpl64.exe 108 PID 2012 wrote to memory of 2348 2012 RtDCpl64.exe 109 PID 2012 wrote to memory of 2348 2012 RtDCpl64.exe 109 PID 2012 wrote to memory of 2348 2012 RtDCpl64.exe 109 PID 3912 wrote to memory of 3736 3912 RtDCpl64.exe 111 PID 3912 wrote to memory of 3736 3912 RtDCpl64.exe 111 PID 3912 wrote to memory of 3736 3912 RtDCpl64.exe 111 PID 2012 wrote to memory of 2348 2012 RtDCpl64.exe 109 PID 2012 wrote to memory of 2348 2012 RtDCpl64.exe 109 PID 1708 wrote to memory of 4260 1708 RtDCpl64.exe 120 PID 1708 wrote to memory of 4260 1708 RtDCpl64.exe 120 PID 1708 wrote to memory of 4260 1708 RtDCpl64.exe 120 PID 1708 wrote to memory of 2116 1708 RtDCpl64.exe 121 PID 1708 wrote to memory of 2116 1708 RtDCpl64.exe 121 PID 1708 wrote to memory of 2116 1708 RtDCpl64.exe 121 PID 1708 wrote to memory of 2116 1708 RtDCpl64.exe 121 PID 1708 wrote to memory of 2116 1708 RtDCpl64.exe 121 PID 1708 wrote to memory of 2204 1708 RtDCpl64.exe 122 PID 1708 wrote to memory of 2204 1708 RtDCpl64.exe 122 PID 1708 wrote to memory of 2204 1708 RtDCpl64.exe 122 PID 2116 wrote to memory of 5036 2116 RtDCpl64.exe 123 PID 2116 wrote to memory of 5036 2116 RtDCpl64.exe 123 PID 2116 wrote to memory of 5036 2116 RtDCpl64.exe 123 PID 2116 wrote to memory of 5036 2116 RtDCpl64.exe 123 PID 2116 wrote to memory of 5036 2116 RtDCpl64.exe 123
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe"C:\Users\Admin\AppData\Local\Temp\2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"C:\Users\Admin\AppData\Roaming\Imgburn\Host.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1852
-
-
-
C:\Users\Admin\AppData\Local\Temp\2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe"C:\Users\Admin\AppData\Local\Temp\2c7bff817a2c3bd0afe3ecb40ac6ee4903d566aaa8343fd06713cedf0b3a33b5N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:768
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:3852
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2348
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3736
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exeC:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe1⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Roaming\Blasthost.exe"C:\Users\Admin\AppData\Roaming\Blasthost.exe"2⤵
- Executes dropped EXE
PID:4260
-
-
C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2116 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:5036
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn raserver /tr "C:\Users\Admin\AppData\Roaming\aepic\RtDCpl64.exe" /sc minute /mo 1 /F2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2204
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
132KB
MD56087bf6af59b9c531f2c9bb421d5e902
SHA18bc0f1596c986179b82585c703bacae6d2a00316
SHA2563a8ffff8485c9ed35dae82574ea1a455ea2ead532251cebea19149d78dfd682c
SHA512c8ed34470a874ce21c91cb7843521d66decc32c3f0a9c8d5b55889a7b990dfe5199ade8b6c6ef94b1bced6d3b5f0721e14bcc06320e8efe73ca3fe27fd6b9292
-
Filesize
1.4MB
MD50a5428d15a98688a40aa7f647d46d310
SHA1d7cdb2b264d827f00d927eb2c91fd0cb3e424577
SHA25694b3daa182839482b843a695f78aa142fb0cae6500ba3d81c5f6046ec07a504a
SHA512bd41416f1aabe2d25683a4154c7af8b560bb2e3b49db0851e2501c096a92079eec7687bff158471cc5d80f49d60f9c2afbd1c13bf672e626afd6a82b95cf85fe