Analysis
-
max time kernel
92s -
max time network
152s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
28-08-2020 06:07
Static task
static1
Behavioral task
behavioral1
Sample
ReQUOTATION_REQUEST20200829.exe
Resource
win7
Behavioral task
behavioral2
Sample
ReQUOTATION_REQUEST20200829.exe
Resource
win10v200722
General
-
Target
ReQUOTATION_REQUEST20200829.exe
-
Size
712KB
-
MD5
2114535592ff9c28d5bd897c10caada2
-
SHA1
dd06260610bc0a4dbfcb0778cd4fdf703e10770e
-
SHA256
30690dd57acb0fdd1b40b8985089381f463d9cc0601605782624283be72be025
-
SHA512
c66835bd7c66a1c957f13257718dc36b8f94af8211995cf776b4dff97e1420bf2be926de64153e4ef6f6a96e8e05fe7d39611a6eb7d6c3b6f3b7f2cc8f3f7537
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3624-13-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/3624-14-0x0000000000405A3D-mapping.dmp warzonerat behavioral2/memory/3624-15-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ReQUOTATION_REQUEST20200829.exedescription pid Process procid_target PID 1496 set thread context of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies data under HKEY_USERS 5 IoCs
Processes:
svchost.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 1799bdf5017dd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ReQUOTATION_REQUEST20200829.exepid Process 1496 ReQUOTATION_REQUEST20200829.exe 1496 ReQUOTATION_REQUEST20200829.exe 1496 ReQUOTATION_REQUEST20200829.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
svchost.exeReQUOTATION_REQUEST20200829.exedescription pid Process Token: SeShutdownPrivilege 2508 svchost.exe Token: SeCreatePagefilePrivilege 2508 svchost.exe Token: SeDebugPrivilege 1496 ReQUOTATION_REQUEST20200829.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ReQUOTATION_REQUEST20200829.exepid Process 3624 ReQUOTATION_REQUEST20200829.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
ReQUOTATION_REQUEST20200829.exedescription pid Process procid_target PID 1496 wrote to memory of 3084 1496 ReQUOTATION_REQUEST20200829.exe 75 PID 1496 wrote to memory of 3084 1496 ReQUOTATION_REQUEST20200829.exe 75 PID 1496 wrote to memory of 3084 1496 ReQUOTATION_REQUEST20200829.exe 75 PID 1496 wrote to memory of 3220 1496 ReQUOTATION_REQUEST20200829.exe 77 PID 1496 wrote to memory of 3220 1496 ReQUOTATION_REQUEST20200829.exe 77 PID 1496 wrote to memory of 3220 1496 ReQUOTATION_REQUEST20200829.exe 77 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grYggiKlrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31A0.tmp"2⤵
- Creates scheduled task(s)
PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"2⤵PID:3220
-
-
C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:3624
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
09153e21a4f241d9b6d94ff8fec250e2
SHA1ebec90e5d250648d7402053c885c376ec62e6927
SHA256084ffd05c3cacc55c8eee647f1519384e8ac6ce02eea9842eb6b12a52b113e79
SHA51202226224bcb365ef55d9631ffd0234aa88a8ad61e67d5f7c2ba428cc1082cacb51b4761889d595336041e5a164b0117a523c622819a36403a74bfc3cce17af06