Analysis
-
max time kernel
143s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 10:41
Static task
static1
Behavioral task
behavioral1
Sample
DOC7790.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
DOC7790.exe
Resource
win10v2004-20240611-en
General
-
Target
DOC7790.exe
-
Size
1.1MB
-
MD5
650343549a8f3d22f8dd073c806daca8
-
SHA1
a51f94d650b75451ac9fd58599c9b5839f415218
-
SHA256
a8a5bfc62922bd09677deb20fe7d4c18a9098bdbc29322c7629d368d9f261a6d
-
SHA512
ab28a2e7b561c30e0d5f1c8f1d2917faa0938a640ec63b8475312fc7e624e857fd66b0e2d9d949ae4e9f3e492b8572b6a2dbf20efcd5b06248eb2b242c460110
-
SSDEEP
6144:exd05BAl92z8P2GhNRavMIuLAhwQI9To0TM4pONBMbvoyA4KhD3Njzx6D:ex+c5P2iNS9ZPysBMcz3Nj
Malware Config
Extracted
warzonerat
212.192.241.54:5200
Signatures
-
Detects BazaLoader malware 5 IoCs
BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.
Processes:
resource yara_rule behavioral2/memory/4060-13-0x0000000000400000-0x000000000055E000-memory.dmp BazaLoader behavioral2/memory/4060-15-0x0000000000400000-0x000000000055E000-memory.dmp BazaLoader behavioral2/memory/4060-17-0x0000000000400000-0x000000000055E000-memory.dmp BazaLoader behavioral2/memory/4060-23-0x0000000000400000-0x000000000055E000-memory.dmp BazaLoader behavioral2/memory/4480-69-0x0000000000400000-0x000000000055E000-memory.dmp BazaLoader -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 5 IoCs
Processes:
resource yara_rule behavioral2/memory/4060-13-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral2/memory/4060-15-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral2/memory/4060-17-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral2/memory/4060-23-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat behavioral2/memory/4480-69-0x0000000000400000-0x000000000055E000-memory.dmp warzonerat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
Processes:
powershell.exepowershell.exepid process 3248 powershell.exe 3192 powershell.exe -
Executes dropped EXE 2 IoCs
Processes:
images.exeimages.exepid process 628 images.exe 4480 images.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DOC7790.exeimages.exedescription pid process target process PID 4472 set thread context of 4060 4472 DOC7790.exe DOC7790.exe PID 628 set thread context of 4480 628 images.exe images.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 3248 powershell.exe 3248 powershell.exe 3192 powershell.exe 3192 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 3248 powershell.exe Token: SeDebugPrivilege 3192 powershell.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
DOC7790.exeDOC7790.execmd.exeimages.exeimages.exedescription pid process target process PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4472 wrote to memory of 4060 4472 DOC7790.exe DOC7790.exe PID 4060 wrote to memory of 3248 4060 DOC7790.exe powershell.exe PID 4060 wrote to memory of 3248 4060 DOC7790.exe powershell.exe PID 4060 wrote to memory of 3248 4060 DOC7790.exe powershell.exe PID 4060 wrote to memory of 4248 4060 DOC7790.exe cmd.exe PID 4060 wrote to memory of 4248 4060 DOC7790.exe cmd.exe PID 4060 wrote to memory of 4248 4060 DOC7790.exe cmd.exe PID 4060 wrote to memory of 628 4060 DOC7790.exe images.exe PID 4060 wrote to memory of 628 4060 DOC7790.exe images.exe PID 4060 wrote to memory of 628 4060 DOC7790.exe images.exe PID 4248 wrote to memory of 3136 4248 cmd.exe reg.exe PID 4248 wrote to memory of 3136 4248 cmd.exe reg.exe PID 4248 wrote to memory of 3136 4248 cmd.exe reg.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 628 wrote to memory of 4480 628 images.exe images.exe PID 4480 wrote to memory of 3192 4480 images.exe powershell.exe PID 4480 wrote to memory of 3192 4480 images.exe powershell.exe PID 4480 wrote to memory of 3192 4480 images.exe powershell.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\DOC7790.exe"C:\Users\Admin\AppData\Local\Temp\DOC7790.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DOC7790.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"4⤵
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\images.exe"{path}"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
1.1MB
MD5650343549a8f3d22f8dd073c806daca8
SHA1a51f94d650b75451ac9fd58599c9b5839f415218
SHA256a8a5bfc62922bd09677deb20fe7d4c18a9098bdbc29322c7629d368d9f261a6d
SHA512ab28a2e7b561c30e0d5f1c8f1d2917faa0938a640ec63b8475312fc7e624e857fd66b0e2d9d949ae4e9f3e492b8572b6a2dbf20efcd5b06248eb2b242c460110
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53bbd2f0f40c0a4148c51327a98957d7b
SHA150e59daef3ed363c0ee24d670c4b7fbdc40c5fbc
SHA2562b71fbfbb096818b44f4b699a9932d27064320d40934e3a71888204aafab60ad
SHA51236fb1bb21931838b38d764165ea927dec8748063d664afb8911509f86bca10dc45af9ea5d99fbf331e4f984f6e95c8df547edfc459e15a5035ebf5212d146845
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_t0jidfbb.dfi.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/628-66-0x0000000074ABE000-0x0000000074ABF000-memory.dmpFilesize
4KB
-
memory/628-24-0x0000000074ABE000-0x0000000074ABF000-memory.dmpFilesize
4KB
-
memory/3192-96-0x0000000007B70000-0x0000000007B84000-memory.dmpFilesize
80KB
-
memory/3192-95-0x0000000007B40000-0x0000000007B51000-memory.dmpFilesize
68KB
-
memory/3192-94-0x0000000007890000-0x0000000007933000-memory.dmpFilesize
652KB
-
memory/3192-84-0x0000000074030000-0x000000007407C000-memory.dmpFilesize
304KB
-
memory/3192-83-0x0000000006660000-0x00000000066AC000-memory.dmpFilesize
304KB
-
memory/3192-81-0x0000000006190000-0x00000000064E4000-memory.dmpFilesize
3.3MB
-
memory/3248-61-0x0000000007110000-0x0000000007124000-memory.dmpFilesize
80KB
-
memory/3248-53-0x00000000061B0000-0x00000000061CE000-memory.dmpFilesize
120KB
-
memory/3248-63-0x00000000071F0000-0x00000000071F8000-memory.dmpFilesize
32KB
-
memory/3248-62-0x0000000007210000-0x000000000722A000-memory.dmpFilesize
104KB
-
memory/3248-60-0x0000000007100000-0x000000000710E000-memory.dmpFilesize
56KB
-
memory/3248-59-0x00000000070D0000-0x00000000070E1000-memory.dmpFilesize
68KB
-
memory/3248-58-0x0000000007150000-0x00000000071E6000-memory.dmpFilesize
600KB
-
memory/3248-57-0x0000000006F40000-0x0000000006F4A000-memory.dmpFilesize
40KB
-
memory/3248-25-0x0000000002200000-0x0000000002236000-memory.dmpFilesize
216KB
-
memory/3248-26-0x0000000004EA0000-0x00000000054C8000-memory.dmpFilesize
6.2MB
-
memory/3248-29-0x0000000004D80000-0x0000000004DE6000-memory.dmpFilesize
408KB
-
memory/3248-28-0x0000000004D10000-0x0000000004D76000-memory.dmpFilesize
408KB
-
memory/3248-27-0x0000000004AF0000-0x0000000004B12000-memory.dmpFilesize
136KB
-
memory/3248-55-0x0000000007510000-0x0000000007B8A000-memory.dmpFilesize
6.5MB
-
memory/3248-39-0x0000000005600000-0x0000000005954000-memory.dmpFilesize
3.3MB
-
memory/3248-41-0x0000000005C40000-0x0000000005C8C000-memory.dmpFilesize
304KB
-
memory/3248-40-0x0000000005BC0000-0x0000000005BDE000-memory.dmpFilesize
120KB
-
memory/3248-42-0x0000000006170000-0x00000000061A2000-memory.dmpFilesize
200KB
-
memory/3248-43-0x0000000070780000-0x00000000707CC000-memory.dmpFilesize
304KB
-
memory/3248-56-0x0000000006ED0000-0x0000000006EEA000-memory.dmpFilesize
104KB
-
memory/3248-54-0x0000000006DB0000-0x0000000006E53000-memory.dmpFilesize
652KB
-
memory/4060-13-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/4060-15-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/4060-23-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/4060-17-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/4472-12-0x0000000006980000-0x00000000069AC000-memory.dmpFilesize
176KB
-
memory/4472-8-0x0000000002DF0000-0x0000000002E04000-memory.dmpFilesize
80KB
-
memory/4472-0-0x000000007514E000-0x000000007514F000-memory.dmpFilesize
4KB
-
memory/4472-11-0x0000000006900000-0x000000000697C000-memory.dmpFilesize
496KB
-
memory/4472-10-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB
-
memory/4472-9-0x000000007514E000-0x000000007514F000-memory.dmpFilesize
4KB
-
memory/4472-1-0x00000000008B0000-0x00000000009D2000-memory.dmpFilesize
1.1MB
-
memory/4472-18-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB
-
memory/4472-7-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB
-
memory/4472-6-0x00000000056C0000-0x0000000005716000-memory.dmpFilesize
344KB
-
memory/4472-5-0x0000000005460000-0x000000000546A000-memory.dmpFilesize
40KB
-
memory/4472-4-0x0000000005520000-0x00000000055B2000-memory.dmpFilesize
584KB
-
memory/4472-3-0x0000000005A30000-0x0000000005FD4000-memory.dmpFilesize
5.6MB
-
memory/4472-2-0x00000000053A0000-0x000000000543C000-memory.dmpFilesize
624KB
-
memory/4480-69-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB