| File name: | WARZONE RAT 2.70 POISON - cortexnet.cc.zip.zip |
| Full analysis: | https://app.any.run/tasks/104b316d-b74f-4bfd-9eab-135b470b41a9 |
| Verdict: | Malicious activity |
| Threats: | A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection. |
| Analysis date: | August 28, 2024, 04:59:14 |
| OS: | Windows 10 Professional (build: 19045, 64 bit) |
| Tags: | |
| Indicators: | |
| MIME: | application/zip |
| File info: | Zip archive data, at least v5.1 to extract, compression method=AES Encrypted |
| MD5: | 5E39F89FE83F25CFA0C7C2F7DC95257D |
| SHA1: | 9709F26772ED554EE559E9786A3694C3DF727DB8 |
| SHA256: | 58F3AFCCB83796B7C4E123C3041362ED3319B0711A477C28B8DA7DE3AF776ADA |
| SSDEEP: | 98304:Bg6WjTm+JgeaS3lR9sc309lrjSGPPUwAcF9rhfiS+qMlb06Itvwp5LZTfRVO+c20:uMUX0e0MhjZx5DRQd+F/Cg97YXmba |
MALICIOUS
WARZONE has been detected (YARA)
- test.exe (PID: 5544)
- test2.exe (PID: 3184)
Create files in the Startup directory
- test2.exe (PID: 3184)
BAZALOADER has been detected (YARA)
- test2.exe (PID: 3184)
- test.exe (PID: 5544)
SUSPICIOUS
Drops the executable file immediately after the start
- WinRAR.exe (PID: 4996)
- test2.exe (PID: 3184)
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
Reads security settings of Internet Explorer
- WinRAR.exe (PID: 4996)
- Warzone Cracked.exe (PID: 3328)
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
The process drops Mozilla's DLL files
- WinRAR.exe (PID: 4996)
- WinRAR.exe (PID: 5768)
Application launched itself
- WinRAR.exe (PID: 4996)
Reads the date of Windows installation
- Warzone Cracked.exe (PID: 3328)
Executable content was dropped or overwritten
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
- test2.exe (PID: 3184)
Detected use of alternative data streams (AltDS)
- test2.exe (PID: 3184)
The process checks if it is being run in the virtual environment
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
INFO
Executable content was dropped or overwritten
- WinRAR.exe (PID: 5768)
Reads the computer name
- Warzone Cracked.exe (PID: 3328)
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
- Inject.exe (PID: 6140)
- test2.exe (PID: 3184)
Checks supported languages
- Warzone Cracked.exe (PID: 3328)
- Inject.exe (PID: 6140)
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
- test.exe (PID: 5544)
- test2.exe (PID: 3184)
Reads the machine GUID from the registry
- Warzone Cracked.exe (PID: 3328)
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
Manual execution by a user
- Warzone Cracked.exe (PID: 3328)
- test2.exe (PID: 3184)
- test.exe (PID: 5544)
Process checks computer location settings
- Warzone Cracked.exe (PID: 3328)
Reads Windows Product ID
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
Creates files or folders in the user directory
- WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
- test2.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
WarZone
(PID) Process(5544) test.exe
C2 (1)127.0.0.0:5200
BuildIDEIM6RXCR8U
Options
Install FlagFalse
Startup FlagFalse
Reverse Proxy local port5000
Offline logFalse
PersistanceFalse
UAC bypassFalse
Defender bypassFalse
Use ADSFalse
(PID) Process(3184) test2.exe
C2 (1)test:5200
BuildIDPIBWQFATZE
Options
Install FlagFalse
Startup FlagFalse
Reverse Proxy local port5000
Offline logFalse
PersistanceFalse
UAC bypassFalse
Defender bypassFalse
Use ADSFalse
TRiD
| .zip | | | ZIP compressed archive (100) |
|---|
EXIF
ZIP
| ZipRequiredVersion: | 51 |
|---|---|
| ZipBitFlag: | 0x0009 |
| ZipCompression: | Unknown (99) |
| ZipModifyDate: | 2024:08:28 04:57:24 |
| ZipCRC: | 0x7ba8bf64 |
| ZipCompressedSize: | 12162286 |
| ZipUncompressedSize: | 12171326 |
| ZipFileName: | WARZONE RAT 2.70 POISON - cortexnet.cc.zip |
Total processes
133
Monitored processes
9
Malicious processes
3
Suspicious processes
1
Behavior graph
Click at the process to see the details
Process information
PID | CMD | Path | Indicators | Parent process | |||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2588 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | Inject.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
| 3184 | "C:\Users\admin\Desktop\test2.exe" | C:\Users\admin\Desktop\test2.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
WarZone(PID) Process(3184) test2.exe C2 (1)test:5200 BuildIDPIBWQFATZE Options Install FlagFalse Startup FlagFalse Reverse Proxy local port5000 Offline logFalse PersistanceFalse UAC bypassFalse Defender bypassFalse Use ADSFalse | |||||||||||||||
| 3328 | "C:\Users\admin\Desktop\Warzone Cracked.exe" | C:\Users\admin\Desktop\Warzone Cracked.exe | — | explorer.exe | |||||||||||
User: admin Integrity Level: MEDIUM Description: Warzone Cracked Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 4996 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\WARZONE RAT 2.70 POISON - cortexnet.cc.zip.zip" | C:\Program Files\WinRAR\WinRAR.exe | — | explorer.exe | |||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 5544 | "C:\Users\admin\Desktop\test.exe" | C:\Users\admin\Desktop\test.exe | explorer.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Modules
WarZone(PID) Process(5544) test.exe C2 (1)127.0.0.0:5200 BuildIDEIM6RXCR8U Options Install FlagFalse Startup FlagFalse Reverse Proxy local port5000 Offline logFalse PersistanceFalse UAC bypassFalse Defender bypassFalse Use ADSFalse | |||||||||||||||
| 5768 | "C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb4996.47707\WARZONE RAT 2.70 POISON - cortexnet.cc.zip" | C:\Program Files\WinRAR\WinRAR.exe | WinRAR.exe | ||||||||||||
User: admin Company: Alexander Roshal Integrity Level: MEDIUM Description: WinRAR archiver Exit code: 0 Version: 5.91.0 Modules
| |||||||||||||||
| 6120 | "C:\Users\admin\Desktop\WARZONE RAT - HIDDEN POISON 2.70.exe" | C:\Users\admin\Desktop\WARZONE RAT - HIDDEN POISON 2.70.exe | Warzone Cracked.exe | ||||||||||||
User: admin Integrity Level: MEDIUM Description: WARZONE RAT - HIDDEN POISON 2.70 Exit code: 0 Version: 2.7.0.0 Modules
| |||||||||||||||
| 6140 | "Injector\Inject.exe" -m Main -i "Injector\Warzone.Loader.dll" -l Cortex.Loader -a "jebac bydgoszcz" -n "WARZONE RAT - HIDDEN POISON 2.70.exe" | C:\Users\admin\Desktop\Injector\Inject.exe | — | Warzone Cracked.exe | |||||||||||
User: admin Company: Plan A Software Integrity Level: MEDIUM Description: An unmanaged command line application for injecting the .net runtime and .net assemblies into x86 or x64 unmanaged or managed remote processes. Exit code: 0 Version: 1.0.0.0 Modules
| |||||||||||||||
| 6716 | \??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1 | C:\Windows\System32\conhost.exe | — | WARZONE RAT - HIDDEN POISON 2.70.exe | |||||||||||
User: admin Company: Microsoft Corporation Integrity Level: MEDIUM Description: Console Window Host Exit code: 0 Version: 10.0.19041.1 (WinBuild.160101.0800) Modules
| |||||||||||||||
Total events
20 298
Read events
20 139
Write events
149
Delete events
10
Modification events
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtBMP |
Value: | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes |
| Operation: | write | Name: | ShellExtIcon |
Value: | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 1 |
Value: C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory |
| Operation: | write | Name: | 0 |
Value: C:\Users\admin\Desktop\WARZONE RAT 2.70 POISON - cortexnet.cc.zip.zip | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | name |
Value: 120 | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | size |
Value: 80 | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | type |
Value: 120 | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths |
| Operation: | write | Name: | mtime |
Value: 100 | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface |
| Operation: | write | Name: | ShowPassword |
Value: 0 | |||
| (PID) Process: | (4996) WinRAR.exe | Key: | HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap |
| Operation: | write | Name: | ProxyBypass |
Value: 1 | |||
Executable files
22
Suspicious files
5
Text files
13
Unknown types
2
Dropped files
PID | Process | Filename | Type | |
|---|---|---|---|---|
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\rdpwrap32.dll | executable | |
MD5:F5C6A32EE3BD88AE44C0C0DFAE950CF0 | SHA256:B9828995474F7E6A6B5C160E5160C5FF49495654A5B89654B6A0F9B8664F82FC | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Injector\Bootstrap.dll | executable | |
MD5:68B1F2580254EE6B18E39B6ED9493CA6 | SHA256:8CF696B44808A84A59C94B61BFA513007466546DA6C996540424B08E4BC0879A | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\firefox.dlls | executable | |
MD5:A26861558315278D5960FE1BF58B1950 | SHA256:B52720863EC78E0F7BFF98E6C809FDF50AB2D0EA361E95EB5341E870AAFB0354 | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\ServerManager.dll | executable | |
MD5:CCC5BD0D95F504FCE814E6758D4953D6 | SHA256:2B658436167826D3A1E44919A1113C6F1717515BD7EF0064D7152D7C3E050FC1 | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\rV2.bsp1 | binary | |
MD5:7DE0184ED564E0D2076D9B3520E7CCE6 | SHA256:4449673175412AACBAB5A485DEAE55DD11B2EFE67A06525DAD05C948542F7387 | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\rvncviewer.exe | executable | |
MD5:27561E722C736AB5A77110790402999B | SHA256:5E49A7FEC8C9F81B191E5FA69BDB1A627814631813FEDFC4136C71E55CD57C0F | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\options.vnc | ini | |
MD5:6243B2004273137CB880196F4472268B | SHA256:11C79026B86D78DF113DD84848065175BC39EFADD48DF4C9768CA685E8FAFFC4 | |||
| 4996 | WinRAR.exe | C:\Users\admin\AppData\Local\Temp\Rar$DIb4996.47707\WARZONE RAT 2.70 POISON - cortexnet.cc.zip | compressed | |
MD5:75D2B322500925478C3060EB7F7067EE | SHA256:CB5D3EE39F883792957F084914406B601C1A52A60ABE75FC566DA1E5CC5A68C4 | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\sqlite3.dll | executable | |
MD5:D3979DB259F55D59B4EDB327673C1905 | SHA256:043E5570299C6099756C1809C5632EABEAB95ED3C1A55C86843C0EC218940E5A | |||
| 5768 | WinRAR.exe | C:\Users\admin\Desktop\Datas\rV.bsp1 | binary | |
MD5:A23A6C143732E1C83BF09FE71C78AA93 | SHA256:E48D338DD5FC668888EB89E6C35E8F4B4F61B4D4BC35574C548A1BC9DBF52054 | |||
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
34
DNS requests
14
Threats
0
HTTP requests
PID | Process | Method | HTTP Code | IP | URL | CN | Type | Size | Reputation |
|---|---|---|---|---|---|---|---|---|---|
4164 | svchost.exe | GET | 200 | 192.229.221.95:80 | http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D | unknown | — | — | whitelisted |
1992 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl | unknown | — | — | whitelisted |
1992 | SIHClient.exe | GET | 200 | 184.30.21.171:80 | http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl | unknown | — | — | whitelisted |
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
Connections
PID | Process | IP | Domain | ASN | CN | Reputation |
|---|---|---|---|---|---|---|
4 | System | 192.168.100.255:138 | — | — | — | whitelisted |
6164 | svchost.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
2120 | MoUsoCoreWorker.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
1084 | RUXIMICS.exe | 20.73.194.208:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4 | System | 192.168.100.255:137 | — | — | — | whitelisted |
6164 | svchost.exe | 4.231.128.59:443 | settings-win.data.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
3260 | svchost.exe | 40.115.3.253:443 | client.wns.windows.com | MICROSOFT-CORP-MSN-AS-BLOCK | NL | whitelisted |
4164 | svchost.exe | 40.126.31.67:443 | login.live.com | MICROSOFT-CORP-MSN-AS-BLOCK | IE | whitelisted |
4164 | svchost.exe | 192.229.221.95:80 | ocsp.digicert.com | EDGECAST | US | whitelisted |
1992 | SIHClient.exe | 20.12.23.50:443 | slscr.update.microsoft.com | MICROSOFT-CORP-MSN-AS-BLOCK | US | whitelisted |
DNS requests
Domain | IP | Reputation |
|---|---|---|
settings-win.data.microsoft.com |
| whitelisted |
google.com |
| whitelisted |
client.wns.windows.com |
| whitelisted |
login.live.com |
| whitelisted |
ocsp.digicert.com |
| whitelisted |
slscr.update.microsoft.com |
| whitelisted |
www.microsoft.com |
| whitelisted |
fe3cr.delivery.mp.microsoft.com |
| whitelisted |