Analysis
-
max time kernel
147s -
max time network
145s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
09-11-2020 20:59
Static task
static1
Behavioral task
behavioral1
Sample
Contract Agreement.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Contract Agreement.exe
Resource
win10v20201028
General
-
Target
Contract Agreement.exe
-
Size
269KB
-
MD5
a38372591737f530b778c116cb6e5c0a
-
SHA1
410afd1494d6953c605260dc4d128d86d7728851
-
SHA256
5c8962c65557bc5ae404143ad8d59911eb2e87fad327ae58f449b2f86cfdd63b
-
SHA512
f1b5d10ac5d75854346fc0bacb715c75355d662eba5494c3821969a359e6c7f4de9c3df92bfb062383423c0ebdcd9c7ae1ee9ba208d129579203b29183fb4d94
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/420-10-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral2/memory/420-11-0x0000000000405907-mapping.dmp warzonerat behavioral2/memory/420-12-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat -
Processes:
resource yara_rule behavioral2/memory/428-6-0x0000000005850000-0x0000000005873000-memory.dmp rezer0 -
Drops startup file 2 IoCs
Processes:
Contract Agreement.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start Contract Agreement.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat Contract Agreement.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Contract Agreement.exedescription pid process target process PID 428 set thread context of 420 428 Contract Agreement.exe Contract Agreement.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
NTFS ADS 2 IoCs
Processes:
Contract Agreement.exedescription ioc process File created C:\ProgramData:ApplicationData Contract Agreement.exe File opened for modification C:\ProgramData:ApplicationData Contract Agreement.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Contract Agreement.exedescription pid process target process PID 428 wrote to memory of 3352 428 Contract Agreement.exe schtasks.exe PID 428 wrote to memory of 3352 428 Contract Agreement.exe schtasks.exe PID 428 wrote to memory of 3352 428 Contract Agreement.exe schtasks.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe PID 428 wrote to memory of 420 428 Contract Agreement.exe Contract Agreement.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Contract Agreement.exe"C:\Users\Admin\AppData\Local\Temp\Contract Agreement.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RDKhAveTgVgGF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4334.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\Contract Agreement.exe"{path}"2⤵
- Drops startup file
- NTFS ADS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4334.tmpMD5
951fbf265a6e605526ebc0438794eb02
SHA1382e5ba25e7339a9976db8b6b27c1cab33619ca3
SHA2561ed71305e63f437c97af9fb4eee209391c576ea8de9957c90fae343b51d29339
SHA5123f14b1d8e8566335b685c6d4bab170907d24ef13e4c492997e9f4de56e162b76ff858ca712796f0e6cdd033ae7b2c93048cb2640128ccac317f98f1184ab0a6a
-
memory/420-10-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/420-11-0x0000000000405907-mapping.dmp
-
memory/420-12-0x0000000000400000-0x0000000000553000-memory.dmpFilesize
1.3MB
-
memory/428-0-0x0000000073160000-0x000000007384E000-memory.dmpFilesize
6.9MB
-
memory/428-1-0x0000000000A00000-0x0000000000A01000-memory.dmpFilesize
4KB
-
memory/428-3-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/428-4-0x0000000001150000-0x000000000115F000-memory.dmpFilesize
60KB
-
memory/428-5-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/428-6-0x0000000005850000-0x0000000005873000-memory.dmpFilesize
140KB
-
memory/428-7-0x0000000005E20000-0x0000000005E21000-memory.dmpFilesize
4KB
-
memory/3352-8-0x0000000000000000-mapping.dmp