Analysis

  • max time kernel
    92s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v200722
  • submitted
    28-08-2020 06:07

General

  • Target

    ReQUOTATION_REQUEST20200829.exe

  • Size

    712KB

  • MD5

    2114535592ff9c28d5bd897c10caada2

  • SHA1

    dd06260610bc0a4dbfcb0778cd4fdf703e10770e

  • SHA256

    30690dd57acb0fdd1b40b8985089381f463d9cc0601605782624283be72be025

  • SHA512

    c66835bd7c66a1c957f13257718dc36b8f94af8211995cf776b4dff97e1420bf2be926de64153e4ef6f6a96e8e05fe7d39611a6eb7d6c3b6f3b7f2cc8f3f7537

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT Payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
    "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1496
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grYggiKlrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31A0.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3084
    • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
      "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
      2⤵
        PID:3220
      • C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
        "C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
        2⤵
        • Suspicious use of SetWindowsHookEx
        PID:3624
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
      1⤵
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious use of AdjustPrivilegeToken
      PID:2508

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1496-7-0x00000000055E0000-0x00000000055E1000-memory.dmp

      Filesize

      4KB

    • memory/1496-9-0x0000000006970000-0x00000000069C1000-memory.dmp

      Filesize

      324KB

    • memory/1496-4-0x0000000005A40000-0x0000000005A41000-memory.dmp

      Filesize

      4KB

    • memory/1496-5-0x0000000005540000-0x0000000005541000-memory.dmp

      Filesize

      4KB

    • memory/1496-6-0x0000000003050000-0x0000000003051000-memory.dmp

      Filesize

      4KB

    • memory/1496-0-0x00000000738E0000-0x0000000073FCE000-memory.dmp

      Filesize

      6.9MB

    • memory/1496-8-0x0000000005880000-0x000000000588B000-memory.dmp

      Filesize

      44KB

    • memory/1496-3-0x00000000054A0000-0x00000000054A1000-memory.dmp

      Filesize

      4KB

    • memory/1496-10-0x00000000069F0000-0x0000000006A1E000-memory.dmp

      Filesize

      184KB

    • memory/1496-1-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

      Filesize

      4KB

    • memory/3624-13-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB

    • memory/3624-15-0x0000000000400000-0x0000000000554000-memory.dmp

      Filesize

      1.3MB