Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/03/2025, 18:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
MACHINE SPECIFICATION/MACHINE SPECIFICATION.exe
Resource
win7-20240903-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
MACHINE SPECIFICATION/MACHINE SPECIFICATION.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
MACHINE SPECIFICATION/tier0_s64.dll
Resource
win7-20240903-en
windows7-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
MACHINE SPECIFICATION/tier0_s64.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
MACHINE SPECIFICATION/vstdlib_s64.dll
Resource
win7-20240903-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral6
Sample
MACHINE SPECIFICATION/vstdlib_s64.dll
Resource
win10v2004-20250217-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
MACHINE SPECIFICATION/vstdlib_s64.dll
-
Size
2.6MB
-
MD5
ba33ebe145dae57fac22d5cc3888c9a0
-
SHA1
1b926c38671e5aa4749c59dc1df0f2c697961a7a
-
SHA256
87659f72a7421b8ed6e2a3d4547ace704fb915d4b2853282677090eb7f664eb7
-
SHA512
f356e033c212730e2c175b95293a38eb2e8ba10c4a94f8b883ee16771cd3b63742b1a6d6f1c4372b75d666e4add5d5ef7ae7afd19d8eb8e8ebbbfc40bdb2859e
-
SSDEEP
24576:y1DLJPcRzGh+FrWTCZqnsTbR1UEMPMvtns7bHf1H26JiyftbIqfX6yXFlY2rXXEK:y1DLJh+RWTCZ7SJZYqfiAqYy21l1nDd
Score
10/10
Malware Config
Extracted
Family
warzonerat
C2
198.46.177.153:4532
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 5 IoCs
resource yara_rule behavioral5/memory/2696-6-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral5/memory/2696-8-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral5/memory/2696-9-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral5/memory/3008-84-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral5/memory/3008-85-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2236 set thread context of 3008 2236 rundll32.exe 39 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmplayer.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2236 rundll32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2236 wrote to memory of 2688 2236 rundll32.exe 30 PID 2236 wrote to memory of 2688 2236 rundll32.exe 30 PID 2236 wrote to memory of 2688 2236 rundll32.exe 30 PID 2236 wrote to memory of 2688 2236 rundll32.exe 30 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2696 2236 rundll32.exe 31 PID 2236 wrote to memory of 2700 2236 rundll32.exe 32 PID 2236 wrote to memory of 2700 2236 rundll32.exe 32 PID 2236 wrote to memory of 2700 2236 rundll32.exe 32 PID 2236 wrote to memory of 2700 2236 rundll32.exe 32 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2752 2236 rundll32.exe 33 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2840 2236 rundll32.exe 34 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2432 2236 rundll32.exe 35 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2556 2236 rundll32.exe 36 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37 PID 2236 wrote to memory of 2992 2236 rundll32.exe 37
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\MACHINE SPECIFICATION\vstdlib_s64.dll",#11⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe"2⤵PID:2688
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe"2⤵PID:2696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"2⤵PID:2700
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2752
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵PID:2840
-
-
C:\Windows\System32\calc.exe"C:\Windows\System32\calc.exe"2⤵PID:2432
-
-
C:\Windows\System32\svchost.exe"C:\Windows\System32\svchost.exe"2⤵PID:2556
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:2992
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2224
-
-
C:\Program Files (x86)\Windows Media Player\wmplayer.exe"C:\Program Files (x86)\Windows Media Player\wmplayer.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3008
-