Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    15-01-2021 15:49

General

  • Target

    LnkxrWO6yvd9qaJ.exe

  • Size

    537KB

  • MD5

    a9933988c3f46eef0110f5d707581e80

  • SHA1

    776002c8099ed9648d4ced12ba06ca4314011ba3

  • SHA256

    a5493fcfa116bae23b26373c6aeec273c025be4798a14a2127dc134ba0b1c8b5

  • SHA512

    d28673ad2aad7ef222c469c0f2a0354f89cb3366fd41beb2b598a4690712dea9ebe14ab568ae76ae72cb076dbb1f962912827f8d2a64f1edee3c1ceb63b89504

Malware Config

Extracted

Family

warzonerat

C2

185.222.58.156:5200

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe
    "C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3496
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cdugnfDV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7F7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:196
    • C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe
      "{path}"
      2⤵
        PID:1548

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpD7F7.tmp
      MD5

      30d88dab2bf3ef058dabaf004a039155

      SHA1

      6d42f85ce35d52f4aad876c1a945ecae99c1a9c6

      SHA256

      55e0d910670755579058a889b062daee722d778229da453e8c9e2e71c3748a0e

      SHA512

      a3d99061e1e56a0ab5d693af4dc11ff036928587137ade0a9fb2963e5ee3bb0fe5a43394d63a78090fd93b47c9bca4fd012d4f699c7082500767ecd6024723f4

    • memory/196-2-0x0000000000000000-mapping.dmp
    • memory/1548-4-0x0000000000400000-0x0000000000554000-memory.dmp
      Filesize

      1.3MB

    • memory/1548-5-0x0000000000405CE2-mapping.dmp
    • memory/1548-6-0x0000000000400000-0x0000000000554000-memory.dmp
      Filesize

      1.3MB