Analysis

  • max time kernel
    58s
  • max time network
    100s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    28-06-2020 23:58

General

  • Target

    Doc_43795379326436.exe

  • Size

    327KB

  • MD5

    24e5934191f08a725c5005adaf753d11

  • SHA1

    21bb5c17690bb277422d855619f0ca7f20182019

  • SHA256

    c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4

  • SHA512

    b8592b9d07d10081f77acfb767d3f7c183a9ab7409d7b9266999e149ad41b83035e76240dcf6de1ab28df7418a57816e05f50614f27ac27238666b56c303278c

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT Payload 10 IoCs
  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • JavaScript code in executable 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • NTFS ADS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 42 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe
    "C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1484
    • C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe
      "C:\Users\Admin\AppData\Local\Temp\Doc_43795379326436.exe"
      2⤵
      • Drops startup file
      • Loads dropped DLL
      • Adds Run key to start application
      • NTFS ADS
      • Suspicious use of WriteProcessMemory
      PID:380
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Add-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1088
      • C:\ProgramData\images.exe
        "C:\ProgramData\images.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1504
        • C:\ProgramData\images.exe
          "C:\ProgramData\images.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:1576
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell Add-MpPreference -ExclusionPath C:\
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1596
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe"
            5⤵
              PID:1628

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\

      MD5

      d41d8cd98f00b204e9800998ecf8427e

      SHA1

      da39a3ee5e6b4b0d3255bfef95601890afd80709

      SHA256

      e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

      SHA512

      cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

    • C:\ProgramData\images.exe

      MD5

      24e5934191f08a725c5005adaf753d11

      SHA1

      21bb5c17690bb277422d855619f0ca7f20182019

      SHA256

      c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4

      SHA512

      b8592b9d07d10081f77acfb767d3f7c183a9ab7409d7b9266999e149ad41b83035e76240dcf6de1ab28df7418a57816e05f50614f27ac27238666b56c303278c

    • C:\ProgramData\images.exe

      MD5

      24e5934191f08a725c5005adaf753d11

      SHA1

      21bb5c17690bb277422d855619f0ca7f20182019

      SHA256

      c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4

      SHA512

      b8592b9d07d10081f77acfb767d3f7c183a9ab7409d7b9266999e149ad41b83035e76240dcf6de1ab28df7418a57816e05f50614f27ac27238666b56c303278c

    • C:\ProgramData\images.exe

      MD5

      24e5934191f08a725c5005adaf753d11

      SHA1

      21bb5c17690bb277422d855619f0ca7f20182019

      SHA256

      c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4

      SHA512

      b8592b9d07d10081f77acfb767d3f7c183a9ab7409d7b9266999e149ad41b83035e76240dcf6de1ab28df7418a57816e05f50614f27ac27238666b56c303278c

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_231c2208-0720-4eec-b9f1-8bba11abd9fa

      MD5

      5e3c7184a75d42dda1a83606a45001d8

      SHA1

      94ca15637721d88f30eb4b6220b805c5be0360ed

      SHA256

      8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

      SHA512

      fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_235184f8-dcca-4459-ace7-181c154dff79

      MD5

      a725bb9fafcf91f3c6b7861a2bde6db2

      SHA1

      8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

      SHA256

      51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

      SHA512

      1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_284c48e7-4cae-4743-923a-5fd03fdf4efd

      MD5

      d89968acfbd0cd60b51df04860d99896

      SHA1

      b3c29916ccb81ce98f95bbf3aa8a73de16298b29

      SHA256

      1020cc7c929cd5a4e68ccb40353ca76f427df363f0d95e456eb79db039bdb2b9

      SHA512

      b0e886cce598371b59131fed1535e220c798691bad93ef9474ba440066f5a6bd77a60966604b7a5ff6298b2e200c9dd0c8f9f04aff208b2af423480ead4e8842

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_57c6647c-75fc-47bb-8ce4-3b8f0921c533

      MD5

      75a8da7754349b38d64c87c938545b1b

      SHA1

      5c28c257d51f1c1587e29164cc03ea880c21b417

      SHA256

      bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

      SHA512

      798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6d5fa298-996f-4fc9-9c01-b2226cbdaeba

      MD5

      02ff38ac870de39782aeee04d7b48231

      SHA1

      0390d39fa216c9b0ecdb38238304e518fb2b5095

      SHA256

      fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

      SHA512

      24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_7d6878ec-2a8b-418c-8f2b-b6fcd4b50cf8

      MD5

      b6d38f250ccc9003dd70efd3b778117f

      SHA1

      d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

      SHA256

      4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

      SHA512

      67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_ab5b847a-2b1b-4e4d-bb88-997cf621d72c

      MD5

      354b8209f647a42e2ce36d8cf326cc92

      SHA1

      98c3117f797df69935f8b09fc9e95accfe3d8346

      SHA256

      feae405d288fdd38438f9d9b54f791f3ce3805f1bb88780da5aca402ad372239

      SHA512

      420be869b58e9a7a2c31f2550ac269df832935692a6431d455a10d9b426781e79d91e30ace2c465633b8a7ff2be1bf49734d8b99a390090dc4b36411d4391ff0

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b7a07a8e-6db9-43a7-b76c-f372771facb9

      MD5

      a70ee38af4bb2b5ed3eeb7cbd1a12fa3

      SHA1

      81dbaeae4b0f9e1adc0a1e3d6d76a12396498ba9

      SHA256

      dd2f41f92f19c3fe031bdf5da68ab06768e26762d0077b290cd0094df1d5d58d

      SHA512

      8c69a5300c7545c5c4b25a0594e6813b6b7a85b5f3ae7fc5464b4074fe6f50b2f49d31cacf19bc20a02bb8e237656f1b9b2a3f6a3953e3a8478ca2adc154e0e3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_de4eedb8-4762-4c56-b80c-203df3aa6fa8

      MD5

      597009ea0430a463753e0f5b1d1a249e

      SHA1

      4e38b8bb65ecbd5c9f0d3d8c47f7caba33de6c62

      SHA256

      3fd2a8217a845c43dbc0dc206c28be81d2687aa9ba62019d905aef10cfaec45d

      SHA512

      5d722fa908e64575b2497c60d142e182011a10c6ed33813b3b4796b3147ece1bc96938518b4c8911a1bac3b7560528ebe3e8e754c11015516d335df5d7c6871d

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e43ce3f6-b60d-4b70-bed1-86e53bf07360

      MD5

      df44874327d79bd75e4264cb8dc01811

      SHA1

      1396b06debed65ea93c24998d244edebd3c0209d

      SHA256

      55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

      SHA512

      95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_f391b72b-32f0-4d11-8a49-2c4d57b0db28

      MD5

      7f79b990cb5ed648f9e583fe35527aa7

      SHA1

      71b177b48c8bd745ef02c2affad79ca222da7c33

      SHA256

      080ec69d3f2abac629a0bdc314f150ad42a9a1b0a031b1d5c7b5b80051c48683

      SHA512

      20926edf7f0b990da4bd8d7ba91bd8bf7b952b75080f687afa7197a91777604688303d38b4a0a7240b558c23f2e0cd927d3590765109f8be0551f5eb050eafda

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fabbb9cf-9b8c-4b2f-b33d-0de7a9a3a10e

      MD5

      be4d72095faf84233ac17b94744f7084

      SHA1

      cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

      SHA256

      b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

      SHA512

      43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex

      MD5

      2313d377b8638d385ae88dd1794776cd

      SHA1

      ac104347c7c80113136be4855cda59502312706d

      SHA256

      2696fb23dd220e5ad2f375b89fba5844e55ce00ce9e03c813ae3eb85650b5d16

      SHA512

      fafaf83d663394ed4b04ad8060e5374274af3b3e41a02ab093861332135909199760ecbf1711f44bb38f17f1d511a58b0c5d1157c01bbeaaece11ff6d6d5482c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      MD5

      2ab625d416bb1536fe607f66d5ab7f49

      SHA1

      e6b25fe65c037590a5e7e3df7c026b6238938137

      SHA256

      348384cf0f8eaef58f7c91c84f072515a7d4ab04a95531e7783a6c792fe38643

      SHA512

      ec1ab089fe739e3bc468f6e5519336f13807497b6b9df49ae335d3a00550b01d3596568108e71daf6173a4c0850eff9d78335c939686e24672eac60a2c5851f0

    • \ProgramData\images.exe

      MD5

      24e5934191f08a725c5005adaf753d11

      SHA1

      21bb5c17690bb277422d855619f0ca7f20182019

      SHA256

      c95ca2828f96e70328cd9ac4dfddad25fb0dcddc2e265200401ce10eecf3c2a4

      SHA512

      b8592b9d07d10081f77acfb767d3f7c183a9ab7409d7b9266999e149ad41b83035e76240dcf6de1ab28df7418a57816e05f50614f27ac27238666b56c303278c

    • \Users\Admin\AppData\Local\Temp\freebl3.dll

      MD5

      ef12ab9d0b231b8f898067b2114b1bc0

      SHA1

      6d90f27b2105945f9bb77039e8b892070a5f9442

      SHA256

      2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7

      SHA512

      2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193

    • \Users\Admin\AppData\Local\Temp\mozglue.dll

      MD5

      75f8cc548cabf0cc800c25047e4d3124

      SHA1

      602676768f9faecd35b48c38a0632781dfbde10c

      SHA256

      fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0

      SHA512

      ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f

    • \Users\Admin\AppData\Local\Temp\msvcp140.dll

      MD5

      109f0f02fd37c84bfc7508d4227d7ed5

      SHA1

      ef7420141bb15ac334d3964082361a460bfdb975

      SHA256

      334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

      SHA512

      46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

    • \Users\Admin\AppData\Local\Temp\nss3.dll

      MD5

      d7858e8449004e21b01d468e9fd04b82

      SHA1

      9524352071ede21c167e7e4f106e9526dc23ef4e

      SHA256

      78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db

      SHA512

      1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440

    • \Users\Admin\AppData\Local\Temp\softokn3.dll

      MD5

      471c983513694ac3002590345f2be0da

      SHA1

      6612b9af4ff6830fa9b7d4193078434ef72f775b

      SHA256

      bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f

      SHA512

      a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410

    • \Users\Admin\AppData\Local\Temp\vcruntime140.dll

      MD5

      7587bf9cb4147022cd5681b015183046

      SHA1

      f2106306a8f6f0da5afb7fc765cfa0757ad5a628

      SHA256

      c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

      SHA512

      0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

    • memory/380-4-0x0000000000405A3D-mapping.dmp

    • memory/380-3-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/380-5-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1088-6-0x0000000000000000-mapping.dmp

    • memory/1484-1-0x0000000000000000-0x0000000000000000-disk.dmp

    • memory/1504-8-0x0000000000000000-mapping.dmp

    • memory/1576-18-0x0000000000405A3D-mapping.dmp

    • memory/1576-20-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/1596-21-0x0000000000000000-mapping.dmp

    • memory/1628-22-0x0000000000000000-mapping.dmp

    • memory/1628-26-0x0000000000130000-0x0000000000131000-memory.dmp

      Filesize

      4KB

    • memory/1628-27-0x0000000000000000-mapping.dmp