Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
19-01-2021 13:10
Static task
static1
Behavioral task
behavioral1
Sample
SHIPPING DOCUMENT.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
SHIPPING DOCUMENT.exe
Resource
win10v20201028
General
-
Target
SHIPPING DOCUMENT.exe
-
Size
894KB
-
MD5
df83820db281080e66e57ca20f2b7f45
-
SHA1
eaf95598907bbcfc067ea97529661e849e369600
-
SHA256
1b239419c0f7b8b7fee565928beaaee9c32d0897a1f4948f72a7a5339fd60b31
-
SHA512
092c428ec3aea82ca1c278d334147aedd347713bca6fcfe3f5035a2890031a9159038df36c3ea9812d059530edc7b953326c6c601cd09e8bbf16fc763b10c2fc
Malware Config
Extracted
warzonerat
40.84.216.183:7600
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1524-15-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/1524-16-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/1524-17-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SHIPPING DOCUMENT.exedescription pid process target process PID 648 set thread context of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
SHIPPING DOCUMENT.exedescription pid process target process PID 648 wrote to memory of 3008 648 SHIPPING DOCUMENT.exe schtasks.exe PID 648 wrote to memory of 3008 648 SHIPPING DOCUMENT.exe schtasks.exe PID 648 wrote to memory of 3008 648 SHIPPING DOCUMENT.exe schtasks.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe PID 648 wrote to memory of 1524 648 SHIPPING DOCUMENT.exe SHIPPING DOCUMENT.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fFIgKSx" /XML "C:\Users\Admin\AppData\Local\Temp\tmp705E.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"C:\Users\Admin\AppData\Local\Temp\SHIPPING DOCUMENT.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp705E.tmpMD5
743f2208a5f8eae6f5430b46913881c0
SHA10bc326a3205cfdc3eaee22b6f6371087ab986621
SHA25694141b3bf73de24f55260bf28c132a6d6e124f7cde79c4b2d490637699f99cda
SHA512ccf9bf5e73fa47d31fcc4de828c2378a48d583b7bd8a83ae4ea7ce9ac875b843372c88b31e8845d57e71aa9873d651034bcf35b6729fe15421e08c521e28ac52
-
memory/648-9-0x00000000050B0000-0x00000000050B1000-memory.dmpFilesize
4KB
-
memory/648-11-0x0000000005110000-0x0000000005133000-memory.dmpFilesize
140KB
-
memory/648-6-0x0000000005470000-0x0000000005471000-memory.dmpFilesize
4KB
-
memory/648-7-0x0000000005010000-0x0000000005011000-memory.dmpFilesize
4KB
-
memory/648-8-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/648-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/648-10-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/648-5-0x0000000004EA0000-0x0000000004EA1000-memory.dmpFilesize
4KB
-
memory/648-12-0x0000000005C70000-0x0000000005CC5000-memory.dmpFilesize
340KB
-
memory/648-3-0x00000000005A0000-0x00000000005A1000-memory.dmpFilesize
4KB
-
memory/1524-15-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1524-16-0x0000000000405CE2-mapping.dmp
-
memory/1524-17-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/3008-13-0x0000000000000000-mapping.dmp