Overview

overview

10

Static

static

3

um_x64.exe

windows7-x64

10

um_x64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 00:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    um_x64.exe

  • Size

    2.2MB

  • MD5

    e2fc229dbf8224232d5281b1b9c12aca

  • SHA1

    36c57d932bff9db9c221911fcc676f00c21cf4e6

  • SHA256

    4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60

  • SHA512

    95d1e3383445210e4cc4574baf7fcd68fb68099f202534108a5120ce776f93b777d112a0175ee41ad5e91b18bddc864ebb89fe7c8817769c3fd16762f1e2a27b

  • SSDEEP

    12288:hw3Pj/+DfNCKml36Ych32o0Fcmr/bXrKT9xiAJ65TTlBDa+zB2av:C3LsN8

Score
10/10
warzoneratdiscoveryexecutioninfostealerrat

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzonerat family
    warzonerat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 56 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 22 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 15 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of UnmapMainImage
    PID:3416
    • C:\Users\Admin\AppData\Local\Temp\um_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\um_x64.exe"
      2⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:5856
      • C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe
        "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionPath C:\
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:5296
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:748
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:5000
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2592
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      2⤵
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:5456
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:1340

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe
      Filesize

      2.2MB

      MD5

      d18f0b30efd9f100f11f81825bae050b

      SHA1

      eacd3786e86ee03b14300c2dc6a08e5cfa2406bf

      SHA256

      73c15f93c957b337b30e6b6712487234738a3e0569611d3aac49896582f7b54c

      SHA512

      e6987f4a553699e80b64217919a066eab2e2f81d13c6c4e53c0c5b423c17ac7f129b86b56512de2e45e21d840e0ba3629ffd6ed2aadb84d4ff19521371e00560

      Download Submit

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vwdmoktv.qnz.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat
      Filesize

      140B

      MD5

      ecc5b5d86ede2421121f64acb30a9bc9

      SHA1

      535300eafe8a923a0140ab9e0fde7d55efb41df5

      SHA256

      6f609fe1726d43b1ea1eda58d6e64601ab25fca3b9a629235f3c2ffe22bcdf4a

      SHA512

      7a5dfe217caac3b84d2ea6e1f6c18bb39abb96ca1f9a2f032a43eb29b4f7de40920f554a9f12c4eb10c4651ae4ad70e3805bc94dcf0beb160f9dabcca63b470f

      Download Submit

    • memory/1620-76-0x0000000002AA0000-0x0000000002C2C000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1620-10-0x0000000002AA0000-0x0000000002C2C000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1620-95-0x0000000077730000-0x00000000778D0000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/1620-15-0x0000000002AA0000-0x0000000002C2C000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1620-9-0x0000000077730000-0x00000000778D0000-memory.dmp

      Filesize

      1.6MB

      Download

    • memory/1620-8-0x00000000777B3000-0x00000000777B4000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2592-74-0x0000000000750000-0x0000000000751000-memory.dmp

      Filesize

      4KB

      Download

    • memory/3416-78-0x0000000009140000-0x0000000009240000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/3416-94-0x0000000007130000-0x0000000007136000-memory.dmp

      Filesize

      24KB

      Download

    • memory/3416-77-0x0000000009140000-0x0000000009240000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/5296-64-0x0000000007B60000-0x0000000007B6E000-memory.dmp

      Filesize

      56KB

      Download

    • memory/5296-61-0x00000000079A0000-0x00000000079AA000-memory.dmp

      Filesize

      40KB

      Download

    • memory/5296-29-0x0000000002CE0000-0x0000000002D16000-memory.dmp

      Filesize

      216KB

      Download

    • memory/5296-30-0x0000000005880000-0x0000000005EA8000-memory.dmp

      Filesize

      6.2MB

      Download

    • memory/5296-31-0x0000000005840000-0x0000000005862000-memory.dmp

      Filesize

      136KB

      Download

    • memory/5296-32-0x0000000005F20000-0x0000000005F86000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5296-33-0x0000000005F90000-0x0000000005FF6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/5296-67-0x0000000007C50000-0x0000000007C58000-memory.dmp

      Filesize

      32KB

      Download

    • memory/5296-43-0x0000000006250000-0x00000000065A4000-memory.dmp

      Filesize

      3.3MB

      Download

    • memory/5296-44-0x0000000006610000-0x000000000662E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/5296-45-0x00000000066A0000-0x00000000066EC000-memory.dmp

      Filesize

      304KB

      Download

    • memory/5296-46-0x0000000006BF0000-0x0000000006C22000-memory.dmp

      Filesize

      200KB

      Download

    • memory/5296-47-0x0000000070A20000-0x0000000070A6C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/5296-57-0x0000000006C30000-0x0000000006C4E000-memory.dmp

      Filesize

      120KB

      Download

    • memory/5296-58-0x0000000007830000-0x00000000078D3000-memory.dmp

      Filesize

      652KB

      Download

    • memory/5296-59-0x0000000007F80000-0x00000000085FA000-memory.dmp

      Filesize

      6.5MB

      Download

    • memory/5296-60-0x0000000007930000-0x000000000794A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/5296-66-0x0000000007C70000-0x0000000007C8A000-memory.dmp

      Filesize

      104KB

      Download

    • memory/5296-62-0x0000000007BB0000-0x0000000007C46000-memory.dmp

      Filesize

      600KB

      Download

    • memory/5296-63-0x0000000007B30000-0x0000000007B41000-memory.dmp

      Filesize

      68KB

      Download

    • memory/5296-65-0x0000000007B70000-0x0000000007B84000-memory.dmp

      Filesize

      80KB

      Download

    • memory/5456-24-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-22-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-23-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-25-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-26-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-27-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-28-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-81-0x0000019AA0F00000-0x0000019AA0F06000-memory.dmp

      Filesize

      24KB

      Download

    • memory/5456-87-0x0000019AA0F00000-0x0000019AA0F06000-memory.dmp

      Filesize

      24KB

      Download

    • memory/5456-16-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-17-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download

    • memory/5456-18-0x0000019AA6690000-0x0000019AA6691000-memory.dmp

      Filesize

      4KB

      Download