Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
15-01-2021 15:49
Static task
static1
Behavioral task
behavioral1
Sample
LnkxrWO6yvd9qaJ.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
LnkxrWO6yvd9qaJ.exe
Resource
win10v20201028
General
-
Target
LnkxrWO6yvd9qaJ.exe
-
Size
537KB
-
MD5
a9933988c3f46eef0110f5d707581e80
-
SHA1
776002c8099ed9648d4ced12ba06ca4314011ba3
-
SHA256
a5493fcfa116bae23b26373c6aeec273c025be4798a14a2127dc134ba0b1c8b5
-
SHA512
d28673ad2aad7ef222c469c0f2a0354f89cb3366fd41beb2b598a4690712dea9ebe14ab568ae76ae72cb076dbb1f962912827f8d2a64f1edee3c1ceb63b89504
Malware Config
Extracted
warzonerat
185.222.58.156:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/360-4-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/360-5-0x0000000000405CE2-mapping.dmp warzonerat behavioral1/memory/360-6-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LnkxrWO6yvd9qaJ.exedescription pid process target process PID 1048 set thread context of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
LnkxrWO6yvd9qaJ.exedescription pid process Token: SeDebugPrivilege 1048 LnkxrWO6yvd9qaJ.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
LnkxrWO6yvd9qaJ.exedescription pid process target process PID 1048 wrote to memory of 1660 1048 LnkxrWO6yvd9qaJ.exe schtasks.exe PID 1048 wrote to memory of 1660 1048 LnkxrWO6yvd9qaJ.exe schtasks.exe PID 1048 wrote to memory of 1660 1048 LnkxrWO6yvd9qaJ.exe schtasks.exe PID 1048 wrote to memory of 1660 1048 LnkxrWO6yvd9qaJ.exe schtasks.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 1048 wrote to memory of 360 1048 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe"C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cdugnfDV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp129.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp129.tmpMD5
cdbe0e3508c2ffede4d9632c6dc0e42d
SHA12a73b9874e9b40de42479b1b6c26c9ffecd306e3
SHA256e3c4784701a98af24903b45f40cd9a662a8601ec4b9a5f779b60a829be75b39c
SHA51273bfce19df323bb48b375bb4b60066e2cd25f6d7a57c4f6981fdd4c5d8fddf51526c5023c78afaa7f28b086048d08947b1541d20c19fa29cad32a0dae4ab7a5a
-
memory/360-4-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/360-5-0x0000000000405CE2-mapping.dmp
-
memory/360-6-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1660-2-0x0000000000000000-mapping.dmp