Analysis
-
max time kernel
150s -
max time network
52s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
09-11-2020 20:59
Static task
static1
Behavioral task
behavioral1
Sample
Contract Agreement.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Contract Agreement.exe
Resource
win10v20201028
General
-
Target
Contract Agreement.exe
-
Size
269KB
-
MD5
a38372591737f530b778c116cb6e5c0a
-
SHA1
410afd1494d6953c605260dc4d128d86d7728851
-
SHA256
5c8962c65557bc5ae404143ad8d59911eb2e87fad327ae58f449b2f86cfdd63b
-
SHA512
f1b5d10ac5d75854346fc0bacb715c75355d662eba5494c3821969a359e6c7f4de9c3df92bfb062383423c0ebdcd9c7ae1ee9ba208d129579203b29183fb4d94
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/476-7-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/476-8-0x0000000000405907-mapping.dmp warzonerat behavioral1/memory/476-9-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat -
Processes:
resource yara_rule behavioral1/memory/2036-4-0x0000000000670000-0x0000000000693000-memory.dmp rezer0 -
Drops startup file 2 IoCs
Processes:
Contract Agreement.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat Contract Agreement.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start Contract Agreement.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Contract Agreement.exedescription pid process target process PID 2036 set thread context of 476 2036 Contract Agreement.exe Contract Agreement.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
NTFS ADS 2 IoCs
Processes:
Contract Agreement.exedescription ioc process File opened for modification C:\ProgramData:ApplicationData Contract Agreement.exe File created C:\ProgramData:ApplicationData Contract Agreement.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Contract Agreement.exedescription pid process target process PID 2036 wrote to memory of 1908 2036 Contract Agreement.exe schtasks.exe PID 2036 wrote to memory of 1908 2036 Contract Agreement.exe schtasks.exe PID 2036 wrote to memory of 1908 2036 Contract Agreement.exe schtasks.exe PID 2036 wrote to memory of 1908 2036 Contract Agreement.exe schtasks.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe PID 2036 wrote to memory of 476 2036 Contract Agreement.exe Contract Agreement.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Contract Agreement.exe"C:\Users\Admin\AppData\Local\Temp\Contract Agreement.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RDKhAveTgVgGF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB7AB.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Contract Agreement.exe"{path}"2⤵
- Drops startup file
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpB7AB.tmpMD5
c249b0c87237c2d67f3538fc51cbd55f
SHA14c77c370cb0646ca2c29e876a657cf83a97b054a
SHA2567eb91af0090c9113c39a21c01383014a3be426d7d8e125a12cea8e2cfc2b55db
SHA51223182ce6b849bb59cb18a647ddec77642f288bcf5944e5fa5b0bfb974d04705b413d3954370068d1c7ef11ffadcefe3d3bc8b9aff357bfe516d8c4759ad2f943
-
memory/476-7-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/476-8-0x0000000000405907-mapping.dmp
-
memory/476-9-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/1908-5-0x0000000000000000-mapping.dmp
-
memory/2036-0-0x0000000074EE0000-0x00000000755CE000-memory.dmpFilesize
6.9MB
-
memory/2036-1-0x0000000000340000-0x0000000000341000-memory.dmpFilesize
4KB
-
memory/2036-3-0x00000000001C0000-0x00000000001CF000-memory.dmpFilesize
60KB
-
memory/2036-4-0x0000000000670000-0x0000000000693000-memory.dmpFilesize
140KB