Analysis
-
max time kernel
60s -
max time network
139s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
19-01-2021 11:29
Static task
static1
Behavioral task
behavioral1
Sample
20210007 Purchase Order.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
20210007 Purchase Order.exe
Resource
win10v20201028
General
-
Target
20210007 Purchase Order.exe
-
Size
866KB
-
MD5
2cb1e8b8664b60243ae9d779d722f15b
-
SHA1
68189a8354d045a0dc176e8580fe0974a393cdb7
-
SHA256
de752497070302674c9ff806fc9c905d9ca2db93d8d6241d4849da79394fe172
-
SHA512
0790c9577f4b19280e3f3ee6eb4f397b4cc368c9bf82b8364760939c0dfcfd53b7aa7cb3beb3b469f6fde87a235e858c3f8cffa46d0c035a5697ad5a2a4c27b7
Malware Config
Extracted
warzonerat
52.146.42.226:5600
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1084-10-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1084-11-0x0000000000405CE2-mapping.dmp warzonerat behavioral1/memory/1084-13-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
20210007 Purchase Order.exedescription pid process target process PID 1632 set thread context of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
20210007 Purchase Order.exedescription pid process target process PID 1632 wrote to memory of 1624 1632 20210007 Purchase Order.exe schtasks.exe PID 1632 wrote to memory of 1624 1632 20210007 Purchase Order.exe schtasks.exe PID 1632 wrote to memory of 1624 1632 20210007 Purchase Order.exe schtasks.exe PID 1632 wrote to memory of 1624 1632 20210007 Purchase Order.exe schtasks.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe PID 1632 wrote to memory of 1084 1632 20210007 Purchase Order.exe 20210007 Purchase Order.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\20210007 Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\20210007 Purchase Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ugmYjfognWv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF122.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\20210007 Purchase Order.exe"C:\Users\Admin\AppData\Local\Temp\20210007 Purchase Order.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpF122.tmpMD5
fc52f57f386d5c3d522d409b36ffdd8c
SHA1d3f1a96e933024c80cabb8a090ef475c2df2c7b1
SHA2561591bb4d1f836e8f4b0059ea27f5ad5b48efd59ac3dd7c6363e415f94b71fc31
SHA5127cf92d6ea360c892cb134e9867327f4ebd41cd01cead075e4612a784d2157eac40961284eeccde42f0767663a98e98de422eb0fcf97a1bb0af8ad73e11566935
-
memory/1084-10-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1084-11-0x0000000000405CE2-mapping.dmp
-
memory/1084-12-0x0000000076341000-0x0000000076343000-memory.dmpFilesize
8KB
-
memory/1084-13-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1624-8-0x0000000000000000-mapping.dmp
-
memory/1632-2-0x00000000745C0000-0x0000000074CAE000-memory.dmpFilesize
6.9MB
-
memory/1632-3-0x0000000001290000-0x0000000001291000-memory.dmpFilesize
4KB
-
memory/1632-5-0x0000000000490000-0x00000000004B3000-memory.dmpFilesize
140KB
-
memory/1632-6-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/1632-7-0x00000000011A0000-0x00000000011F5000-memory.dmpFilesize
340KB