Analysis
- max time kernel
136s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:46
General
- Target Factura_de_Cobro.exe
- Size 764KB
- Sample201109-4byhdkseen
- SHA256 0ca6d24907152bf5a6dd6a35cf7ab3e7712ebfa0a2245f2bdfc8a17ebed71bc4
Malware Config
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- ServiceHost packer 1 IoCs
Detects ServiceHost packer used for .NET malware
- Warzone RAT Payload 1 IoCs
- Drops startup file 2 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Factura_de_Cobro.exe"C:\Users\Admin\AppData\Local\Temp\Factura_de_Cobro.exe"1⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4188-10-0x0000000007360000-0x0000000007361000-memory.dmp
memory/4188-23-0x0000000008B10000-0x0000000008B11000-memory.dmp
memory/4188-28-0x0000000008DD0000-0x0000000008DD1000-memory.dmp
memory/4188-3-0x00000000737E0000-0x0000000073ECE000-memory.dmp
memory/4188-4-0x0000000000C40000-0x0000000000C41000-memory.dmp
memory/4188-5-0x0000000006AD0000-0x0000000006AD1000-memory.dmp
memory/4188-26-0x0000000008DF0000-0x0000000008DF1000-memory.dmp
memory/4188-25-0x0000000008E90000-0x0000000008E91000-memory.dmp
memory/4188-8-0x0000000007100000-0x0000000007101000-memory.dmp
memory/4188-9-0x00000000071A0000-0x00000000071A1000-memory.dmp
memory/4188-11-0x00000000074D0000-0x00000000074D1000-memory.dmp
memory/4188-24-0x0000000008C70000-0x0000000008C71000-memory.dmp
memory/4188-13-0x0000000007CE0000-0x0000000007CE1000-memory.dmp
memory/4188-14-0x0000000007C20000-0x0000000007C21000-memory.dmp
memory/4188-16-0x0000000008B30000-0x0000000008B63000-memory.dmp
memory/4188-12-0x0000000007290000-0x0000000007291000-memory.dmp
memory/4204-6-0x0000000001020000-0x0000000001021000-memory.dmp
memory/4632-0-0x0000000002320000-0x0000000002473000-memory.dmp