Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows7_x64 -
resource
win7 -
submitted
25-06-2020 13:39
Static task
static1
Behavioral task
behavioral1
Sample
DHL DOC No_SINI0068206497_PDF.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
DHL DOC No_SINI0068206497_PDF.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
DHL DOC No_SINI0068206497_PDF.exe
-
Size
2.0MB
-
MD5
aade658ec7f1e9aa00f25975c65f361c
-
SHA1
2e6901c0e9182e946a2499d0dce8d98a8837b011
-
SHA256
da8e89fa0cbec2f66ea695865de7a0eb7f9211c10aae3598490bbaec4f83ebfc
-
SHA512
0c3e6180202c777a0ed285e7304bb4e4c4ed9e2a35cbc8a66259386e0adb988cdf5e587f5e35bedcda5173e1821e99b0c2420659c482f481d4199451de9a8e6e
Score
10/10
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 2 IoCs
resource yara_rule behavioral1/memory/608-0-0x0000000002B30000-0x0000000002C83000-memory.dmp warzonerat behavioral1/memory/1004-7-0x00000000029B0000-0x0000000002B03000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
pid Process 1004 intelx.exe -
Loads dropped DLL 1 IoCs
pid Process 608 DHL DOC No_SINI0068206497_PDF.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\intelx = "C:\\ProgramData\\intelx.exe" DHL DOC No_SINI0068206497_PDF.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1476 powershell.exe 1476 powershell.exe 1536 powershell.exe 1536 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1476 powershell.exe Token: SeDebugPrivilege 1536 powershell.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 608 wrote to memory of 1476 608 DHL DOC No_SINI0068206497_PDF.exe 25 PID 608 wrote to memory of 1476 608 DHL DOC No_SINI0068206497_PDF.exe 25 PID 608 wrote to memory of 1476 608 DHL DOC No_SINI0068206497_PDF.exe 25 PID 608 wrote to memory of 1476 608 DHL DOC No_SINI0068206497_PDF.exe 25 PID 608 wrote to memory of 1004 608 DHL DOC No_SINI0068206497_PDF.exe 27 PID 608 wrote to memory of 1004 608 DHL DOC No_SINI0068206497_PDF.exe 27 PID 608 wrote to memory of 1004 608 DHL DOC No_SINI0068206497_PDF.exe 27 PID 608 wrote to memory of 1004 608 DHL DOC No_SINI0068206497_PDF.exe 27 PID 1004 wrote to memory of 1536 1004 intelx.exe 29 PID 1004 wrote to memory of 1536 1004 intelx.exe 29 PID 1004 wrote to memory of 1536 1004 intelx.exe 29 PID 1004 wrote to memory of 1536 1004 intelx.exe 29 PID 1004 wrote to memory of 1524 1004 intelx.exe 30 PID 1004 wrote to memory of 1524 1004 intelx.exe 30 PID 1004 wrote to memory of 1524 1004 intelx.exe 30 PID 1004 wrote to memory of 1524 1004 intelx.exe 30 PID 1004 wrote to memory of 1524 1004 intelx.exe 30 PID 1004 wrote to memory of 1524 1004 intelx.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\DHL DOC No_SINI0068206497_PDF.exe"C:\Users\Admin\AppData\Local\Temp\DHL DOC No_SINI0068206497_PDF.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476
-
-
C:\ProgramData\intelx.exe"C:\ProgramData\intelx.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1524
-
-