Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-01-2021 15:49
Static task
static1
Behavioral task
behavioral1
Sample
LnkxrWO6yvd9qaJ.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
LnkxrWO6yvd9qaJ.exe
Resource
win10v20201028
General
-
Target
LnkxrWO6yvd9qaJ.exe
-
Size
537KB
-
MD5
a9933988c3f46eef0110f5d707581e80
-
SHA1
776002c8099ed9648d4ced12ba06ca4314011ba3
-
SHA256
a5493fcfa116bae23b26373c6aeec273c025be4798a14a2127dc134ba0b1c8b5
-
SHA512
d28673ad2aad7ef222c469c0f2a0354f89cb3366fd41beb2b598a4690712dea9ebe14ab568ae76ae72cb076dbb1f962912827f8d2a64f1edee3c1ceb63b89504
Malware Config
Extracted
warzonerat
185.222.58.156:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1548-4-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/1548-5-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/1548-6-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
LnkxrWO6yvd9qaJ.exedescription pid process target process PID 3496 set thread context of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
LnkxrWO6yvd9qaJ.exepid process 3496 LnkxrWO6yvd9qaJ.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
LnkxrWO6yvd9qaJ.exedescription pid process Token: SeDebugPrivilege 3496 LnkxrWO6yvd9qaJ.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
LnkxrWO6yvd9qaJ.exedescription pid process target process PID 3496 wrote to memory of 196 3496 LnkxrWO6yvd9qaJ.exe schtasks.exe PID 3496 wrote to memory of 196 3496 LnkxrWO6yvd9qaJ.exe schtasks.exe PID 3496 wrote to memory of 196 3496 LnkxrWO6yvd9qaJ.exe schtasks.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe PID 3496 wrote to memory of 1548 3496 LnkxrWO6yvd9qaJ.exe LnkxrWO6yvd9qaJ.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe"C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\cdugnfDV" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD7F7.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\LnkxrWO6yvd9qaJ.exe"{path}"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD7F7.tmpMD5
30d88dab2bf3ef058dabaf004a039155
SHA16d42f85ce35d52f4aad876c1a945ecae99c1a9c6
SHA25655e0d910670755579058a889b062daee722d778229da453e8c9e2e71c3748a0e
SHA512a3d99061e1e56a0ab5d693af4dc11ff036928587137ade0a9fb2963e5ee3bb0fe5a43394d63a78090fd93b47c9bca4fd012d4f699c7082500767ecd6024723f4
-
memory/196-2-0x0000000000000000-mapping.dmp
-
memory/1548-4-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1548-5-0x0000000000405CE2-mapping.dmp
-
memory/1548-6-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB