Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    09/11/2020, 19:52

General

  • Target
    Puchase order.xlsx.exe
  • Size 160KB
  • Sample201109-nqrbqs76a2
  • SHA256 7ef4d076daed6715cc44b4dcbe6e6231fa10bdc66fab9d13befb16dcdfbc50ab
  • MD5 SHA1 SHA512

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT Payload 3 IoCs
  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 5376 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Puchase order.xlsx.exe
    "C:\Users\Admin\AppData\Local\Temp\Puchase order.xlsx.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:492
    • C:\Users\Admin\AppData\Local\Temp\Puchase order.xlsx.exe
      "C:\Users\Admin\AppData\Local\Temp\Puchase order.xlsx.exe"
      2⤵
      • Drops startup file
      • NTFS ADS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:688
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Add-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:1712

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/688-2-0x0000000000400000-0x0000000000557000-memory.dmp

        memory/688-4-0x0000000000400000-0x0000000000557000-memory.dmp

        memory/1712-6-0x0000000072F00000-0x00000000735EE000-memory.dmp

        memory/1712-7-0x0000000004D40000-0x0000000004D41000-memory.dmp

        memory/1712-8-0x00000000077C0000-0x00000000077C1000-memory.dmp

        memory/1712-9-0x0000000007760000-0x0000000007761000-memory.dmp

        memory/1712-10-0x0000000008040000-0x0000000008041000-memory.dmp

        memory/1712-11-0x0000000007E60000-0x0000000007E61000-memory.dmp

        memory/1712-12-0x00000000080B0000-0x00000000080B1000-memory.dmp

        memory/1712-13-0x00000000073B0000-0x00000000073B1000-memory.dmp

        memory/1712-14-0x0000000008970000-0x0000000008971000-memory.dmp

        memory/1712-15-0x0000000008800000-0x0000000008801000-memory.dmp

        memory/1712-17-0x00000000097C0000-0x00000000097F3000-memory.dmp

        memory/1712-24-0x00000000097A0000-0x00000000097A1000-memory.dmp

        memory/1712-25-0x0000000009900000-0x0000000009901000-memory.dmp

        memory/1712-26-0x0000000009B30000-0x0000000009B31000-memory.dmp

        memory/1712-27-0x0000000009A90000-0x0000000009A91000-memory.dmp

        memory/1712-29-0x00000000085B0000-0x00000000085B1000-memory.dmp