Analysis
-
max time kernel
92s -
max time network
152s -
platform
windows10_x64 -
resource
win10v200722 -
submitted
28-08-2020 06:07
Static task
static1
Behavioral task
behavioral1
Sample
ReQUOTATION_REQUEST20200829.exe
Resource
win7
Behavioral task
behavioral2
Sample
ReQUOTATION_REQUEST20200829.exe
Resource
win10v200722
General
-
Target
ReQUOTATION_REQUEST20200829.exe
-
Size
712KB
-
MD5
2114535592ff9c28d5bd897c10caada2
-
SHA1
dd06260610bc0a4dbfcb0778cd4fdf703e10770e
-
SHA256
30690dd57acb0fdd1b40b8985089381f463d9cc0601605782624283be72be025
-
SHA512
c66835bd7c66a1c957f13257718dc36b8f94af8211995cf776b4dff97e1420bf2be926de64153e4ef6f6a96e8e05fe7d39611a6eb7d6c3b6f3b7f2cc8f3f7537
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
resource yara_rule behavioral2/memory/3624-13-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/3624-14-0x0000000000405A3D-mapping.dmp warzonerat behavioral2/memory/3624-15-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1496 set thread context of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3084 schtasks.exe -
Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 1799bdf5017dd601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1496 ReQUOTATION_REQUEST20200829.exe 1496 ReQUOTATION_REQUEST20200829.exe 1496 ReQUOTATION_REQUEST20200829.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 2508 svchost.exe Token: SeCreatePagefilePrivilege 2508 svchost.exe Token: SeDebugPrivilege 1496 ReQUOTATION_REQUEST20200829.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3624 ReQUOTATION_REQUEST20200829.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1496 wrote to memory of 3084 1496 ReQUOTATION_REQUEST20200829.exe 75 PID 1496 wrote to memory of 3084 1496 ReQUOTATION_REQUEST20200829.exe 75 PID 1496 wrote to memory of 3084 1496 ReQUOTATION_REQUEST20200829.exe 75 PID 1496 wrote to memory of 3220 1496 ReQUOTATION_REQUEST20200829.exe 77 PID 1496 wrote to memory of 3220 1496 ReQUOTATION_REQUEST20200829.exe 77 PID 1496 wrote to memory of 3220 1496 ReQUOTATION_REQUEST20200829.exe 77 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78 PID 1496 wrote to memory of 3624 1496 ReQUOTATION_REQUEST20200829.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grYggiKlrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31A0.tmp"2⤵
- Creates scheduled task(s)
PID:3084
-
-
C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"2⤵PID:3220
-
-
C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:3624
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2508