Analysis
- max time kernel
147s - max time network
147s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:44
General
- Target GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr
- Size 705KB
- Sample201109-rt13h4btx6
- SHA256 074a27ca162b894fea8bd9446e45b40e5342a07024589f3ad28e873d7fd9d8c8
Score
10/10
Malware Config
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr"C:\Users\Admin\AppData\Local\Temp\GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr"C:\Users\Admin\AppData\Local\Temp\GF ISF Required Elements Worksheet v2 0 (new) - HL-US.scr" /S2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1496-5-0x0000000000130000-0x0000000000131000-memory.dmp
memory/1496-4-0x0000000000140000-0x0000000000141000-memory.dmp
memory/1972-0-0x0000000000400000-0x0000000000553000-memory.dmp
memory/1972-2-0x0000000000400000-0x0000000000553000-memory.dmp