Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-01-2021 18:59
Static task
static1
Behavioral task
behavioral1
Sample
Leaked sex Tape MT Govt -copy- JPEG.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
Leaked sex Tape MT Govt -copy- JPEG.exe
Resource
win10v20201028
General
-
Target
Leaked sex Tape MT Govt -copy- JPEG.exe
-
Size
296KB
-
MD5
364e06fdc0046cc32b4a524d5aaf5a45
-
SHA1
7655db23b8887da6da8c5be7f3378ac715afcb2b
-
SHA256
cf6fc4b3a468d55d129b5289cde3faa6221f5ff683cd044822764e974b75fbd0
-
SHA512
eab4b6c9dae3b8d69d71d97c8b86665e34d2fef1c2edf30b05b09bd7a545b35ee405a36195c0c510d670f9b4533e921056649747ee2d3f2c02f7d07eee907f20
Malware Config
Extracted
warzonerat
dompe.awsmppl.com:4050
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1380-6-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/1380-7-0x0000000000405738-mapping.dmp warzonerat behavioral1/memory/1380-8-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Drops startup file 2 IoCs
Processes:
Leaked sex Tape MT Govt -copy- JPEG.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Leaked sex Tape MT Govt -copy- JPEG.exedescription pid process target process PID 476 set thread context of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
Leaked sex Tape MT Govt -copy- JPEG.exepid process 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe 476 Leaked sex Tape MT Govt -copy- JPEG.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Leaked sex Tape MT Govt -copy- JPEG.exedescription pid process Token: SeDebugPrivilege 476 Leaked sex Tape MT Govt -copy- JPEG.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Leaked sex Tape MT Govt -copy- JPEG.exedescription pid process target process PID 476 wrote to memory of 1356 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1356 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1356 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1356 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe PID 476 wrote to memory of 1380 476 Leaked sex Tape MT Govt -copy- JPEG.exe Leaked sex Tape MT Govt -copy- JPEG.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Leaked sex Tape MT Govt -copy- JPEG.exe"C:\Users\Admin\AppData\Local\Temp\Leaked sex Tape MT Govt -copy- JPEG.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Leaked sex Tape MT Govt -copy- JPEG.exe"C:\Users\Admin\AppData\Local\Temp\Leaked sex Tape MT Govt -copy- JPEG.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Leaked sex Tape MT Govt -copy- JPEG.exe"C:\Users\Admin\AppData\Local\Temp\Leaked sex Tape MT Govt -copy- JPEG.exe"2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/460-9-0x000007FEF74B0000-0x000007FEF772A000-memory.dmpFilesize
2.5MB
-
memory/476-2-0x0000000073F20000-0x000000007460E000-memory.dmpFilesize
6.9MB
-
memory/476-3-0x0000000000E30000-0x0000000000E31000-memory.dmpFilesize
4KB
-
memory/476-5-0x0000000000980000-0x00000000009AE000-memory.dmpFilesize
184KB
-
memory/1380-6-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/1380-7-0x0000000000405738-mapping.dmp
-
memory/1380-8-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB