Analysis
-
max time kernel
139s -
max time network
101s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 16:22
General
-
Target
JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.exe
-
Size
994KB
-
MD5
86c59d1e4de693a0f5d2ffe3b1cd8ef9
-
SHA1
64e5247411bbeff10fb09f0f8efe3d923d13f0a5
-
SHA256
ae0867ee2b8d439245831fa1884fc5ef80cf9e38e43d1059e8030d2c433e4040
-
SHA512
1ef4ea0020c2f2058b369e045a8a5eea071dd73408507ab06dcef1f1b9fbd1b8bf96ef73cb756296a4d7646185eb1e1c01814f9d23446f27ac14d625e36284c5
Malware Config
Extracted
warzonerat
urchy.duckdns.org:30251
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.exe"C:\Users\Admin\AppData\Local\Temp\JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\biBtzY" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6384.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.exe"C:\Users\Admin\AppData\Local\Temp\JANUARY QUOTATION FOR PRODUCT ORDER 02983H G FOR Goldolphin INDUSTRIES LTD PACKING LIST FOR 60MM.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
86c59d1e4de693a0f5d2ffe3b1cd8ef9
SHA164e5247411bbeff10fb09f0f8efe3d923d13f0a5
SHA256ae0867ee2b8d439245831fa1884fc5ef80cf9e38e43d1059e8030d2c433e4040
SHA5121ef4ea0020c2f2058b369e045a8a5eea071dd73408507ab06dcef1f1b9fbd1b8bf96ef73cb756296a4d7646185eb1e1c01814f9d23446f27ac14d625e36284c5
-
MD5
86c59d1e4de693a0f5d2ffe3b1cd8ef9
SHA164e5247411bbeff10fb09f0f8efe3d923d13f0a5
SHA256ae0867ee2b8d439245831fa1884fc5ef80cf9e38e43d1059e8030d2c433e4040
SHA5121ef4ea0020c2f2058b369e045a8a5eea071dd73408507ab06dcef1f1b9fbd1b8bf96ef73cb756296a4d7646185eb1e1c01814f9d23446f27ac14d625e36284c5
-
MD5
f66f77bcf974f87db0a55bdc3ea95e39
SHA148b6e70ab1643271fedcde9fcea33a73adcb31ae
SHA2566078cc1f37dec442f9cbe20191e0c3bf25db024672a19c795c579375054a1274
SHA5127ee118c1ae6d87cd3be33b293a36a0170f2685c9fab9895c4cf767ef0bb5214322d5f183ce5d089fa769841ede7746e6e951b70099d7e6931b4f86c3715fa02a
-
MD5
86c59d1e4de693a0f5d2ffe3b1cd8ef9
SHA164e5247411bbeff10fb09f0f8efe3d923d13f0a5
SHA256ae0867ee2b8d439245831fa1884fc5ef80cf9e38e43d1059e8030d2c433e4040
SHA5121ef4ea0020c2f2058b369e045a8a5eea071dd73408507ab06dcef1f1b9fbd1b8bf96ef73cb756296a4d7646185eb1e1c01814f9d23446f27ac14d625e36284c5
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
-
Filesize
1.3MB
-
Filesize
8KB
-
Filesize
1.3MB
-
-
Filesize
4KB
-
Filesize
6.9MB
-
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
340KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
4KB