Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/11/2020, 17:52
General
- Target 8524dfc73a322ddeda2681ad153ae582ecc4a9e5ddb1fabdfaf99039176be159.exe
- Size 1.6MB
- Sample201114-df3bysb6js
- SHA256 8524dfc73a322ddeda2681ad153ae582ecc4a9e5ddb1fabdfaf99039176be159
Malware Config
Extracted
-
warzonerat
-
minekroft.duckdns.org:5200
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 2 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8524dfc73a322ddeda2681ad153ae582ecc4a9e5ddb1fabdfaf99039176be159.exe"C:\Users\Admin\AppData\Local\Temp\8524dfc73a322ddeda2681ad153ae582ecc4a9e5ddb1fabdfaf99039176be159.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1736-30-0x0000000001FF0000-0x0000000002144000-memory.dmp
memory/2916-23-0x0000000008F50000-0x0000000008F51000-memory.dmp
memory/2916-11-0x0000000007B60000-0x0000000007B61000-memory.dmp
memory/2916-14-0x0000000008230000-0x0000000008231000-memory.dmp
memory/2916-16-0x0000000008F70000-0x0000000008FA3000-memory.dmp
memory/2916-24-0x0000000009130000-0x0000000009131000-memory.dmp
memory/2916-25-0x0000000009490000-0x0000000009491000-memory.dmp
memory/2916-26-0x0000000009440000-0x0000000009441000-memory.dmp
memory/2916-28-0x0000000009430000-0x0000000009431000-memory.dmp
memory/2916-12-0x0000000007340000-0x0000000007341000-memory.dmp
memory/2916-5-0x0000000073CC0000-0x00000000743AE000-memory.dmp
memory/2916-13-0x0000000007F30000-0x0000000007F31000-memory.dmp
memory/2916-6-0x00000000046B0000-0x00000000046B1000-memory.dmp
memory/2916-7-0x00000000074E0000-0x00000000074E1000-memory.dmp
memory/2916-10-0x00000000071F0000-0x00000000071F1000-memory.dmp
memory/2916-8-0x0000000007130000-0x0000000007131000-memory.dmp
memory/2916-9-0x00000000072B0000-0x00000000072B1000-memory.dmp
memory/4436-53-0x0000000009BD0000-0x0000000009BD1000-memory.dmp
memory/4436-42-0x0000000008CB0000-0x0000000008CB1000-memory.dmp
memory/4436-39-0x00000000083C0000-0x00000000083C1000-memory.dmp
memory/4436-33-0x00000000731B0000-0x000000007389E000-memory.dmp
memory/4692-0-0x0000000000C00000-0x0000000000D54000-memory.dmp