Analysis

  • max time kernel
    131s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    23-02-2021 11:33

General

  • Target

    Swift copy .xls.exe

  • Size

    275KB

  • Sample

    210223-3xnxq2mccs

  • MD5

    d52753f796e8539c7cd55f093e707a99

  • SHA1

    f8f8bedc53dc3ef9ec95d8189d4a83fb66c07acd

  • SHA256

    9179ffac8f35e73f35673a16efe0144858415cb462387ad524889d25ab72a052

  • SHA512

    fc19476b0ddbff3f86cb8c5f19ca4ded1210879242b0be0551859094571ffe08664f5102bb3e5600514892790d175fcfdb26bd4cf4a2f6f421e355c24dc8753a

Malware Config

Extracted

Family

warzonerat

C2

194.5.97.116:1360

Signatures 15

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT Payload ⋅ 3 IoCs
  • Sets DLL path for service in the registry ⋅ 2 TTPs
  • Loads dropped DLL ⋅ 7 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Modifies WinLogon ⋅ 2 TTPs 4 IoCs
  • Drops file in System32 directory ⋅ 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Suspicious behavior: LoadsDriver ⋅ 3 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 16 IoCs

Processes 3

  • C:\Users\Admin\AppData\Local\Temp\Swift copy .xls.exe
    "C:\Users\Admin\AppData\Local\Temp\Swift copy .xls.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AsLvNjC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD92F.tmp"
      Creates scheduled task(s)
      PID:1508
    • C:\Users\Admin\AppData\Local\Temp\Swift copy .xls.exe
      "{path}"
      Loads dropped DLL
      Modifies WinLogon
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      PID:1564

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Privilege Escalation

                Replay Monitor

                00:00 00:00

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\tmpD92F.tmp
                  MD5

                  4bd744f297162b8b562a4952abb92105

                  SHA1

                  840481880734410f1c1d65207f7ffdcd6b076b3e

                  SHA256

                  7a57054734bce7716aa425874bb1a13ef39028479023bb7bcf68a828a7385dce

                  SHA512

                  5c94b3f8a7e98a761981d6f6b8d827753af496ccb09d0e6e283ac2c5efe315fe30807e7b6e6392ac65db41b71dca33beb9b45a6f5e3b5636093c78659831400a

                • \Program Files\Microsoft DN1\sqlmap.dll
                  MD5

                  461ade40b800ae80a40985594e1ac236

                  SHA1

                  b3892eef846c044a2b0785d54a432b3e93a968c8

                  SHA256

                  798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

                  SHA512

                  421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

                • \Users\Admin\AppData\Local\Temp\freebl3.dll
                  MD5

                  ef12ab9d0b231b8f898067b2114b1bc0

                  SHA1

                  6d90f27b2105945f9bb77039e8b892070a5f9442

                  SHA256

                  2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7

                  SHA512

                  2aa62bfba556ad8f042942dd25aa071ff6677c257904377c1ec956fd9e862abcbf379e0cfd8c630c303a32ece75618c24e3eef58bddb705c427985b944689193

                • \Users\Admin\AppData\Local\Temp\mozglue.dll
                  MD5

                  75f8cc548cabf0cc800c25047e4d3124

                  SHA1

                  602676768f9faecd35b48c38a0632781dfbde10c

                  SHA256

                  fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0

                  SHA512

                  ed831c9c769aef3be253c52542cf032afa0a8fa5fe25ca704db65ee6883c608220df7102ac2b99ee9c2e599a0f5db99fd86894a4b169e68440eb1b0d0012672f

                • \Users\Admin\AppData\Local\Temp\msvcp140.dll
                  MD5

                  109f0f02fd37c84bfc7508d4227d7ed5

                  SHA1

                  ef7420141bb15ac334d3964082361a460bfdb975

                  SHA256

                  334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4

                  SHA512

                  46eb62b65817365c249b48863d894b4669e20fcb3992e747cd5c9fdd57968e1b2cf7418d1c9340a89865eadda362b8db51947eb4427412eb83b35994f932fd39

                • \Users\Admin\AppData\Local\Temp\nss3.dll
                  MD5

                  d7858e8449004e21b01d468e9fd04b82

                  SHA1

                  9524352071ede21c167e7e4f106e9526dc23ef4e

                  SHA256

                  78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db

                  SHA512

                  1e2c981e6c0ca36c60c6e9cae9548b866d5c524df837095b30d618d9c322def7134c20de820105400dd1b58076b66d90274f67773ac6ba914f611b419babb440

                • \Users\Admin\AppData\Local\Temp\softokn3.dll
                  MD5

                  471c983513694ac3002590345f2be0da

                  SHA1

                  6612b9af4ff6830fa9b7d4193078434ef72f775b

                  SHA256

                  bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f

                  SHA512

                  a9b0fb923bc3b567e933de10b141a3e9213640e3d790b4c4d753cf220d55593ae8026102909969ba6bfc22da3b2fcd01e30a9f5a74bd14a0fdec9beaf0fb1410

                • \Users\Admin\AppData\Local\Temp\vcruntime140.dll
                  MD5

                  7587bf9cb4147022cd5681b015183046

                  SHA1

                  f2106306a8f6f0da5afb7fc765cfa0757ad5a628

                  SHA256

                  c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d

                  SHA512

                  0b63e4979846ceba1b1ed8470432ea6aa18cca66b5f5322d17b14bc0dfa4b2ee09ca300a016e16a01db5123e4e022820698f46d9bad1078bd24675b4b181e91f

                • memory/1004-14-0x000007FEF56D0000-0x000007FEF594A000-memory.dmp
                • memory/1064-2-0x00000000740B0000-0x000000007479E000-memory.dmp
                • memory/1064-7-0x0000000004420000-0x0000000004468000-memory.dmp
                • memory/1064-6-0x00000000003F0000-0x00000000003FB000-memory.dmp
                • memory/1064-5-0x0000000004F00000-0x0000000004F01000-memory.dmp
                • memory/1064-3-0x0000000000EA0000-0x0000000000EA1000-memory.dmp
                • memory/1508-8-0x0000000000000000-mapping.dmp
                • memory/1564-16-0x0000000003060000-0x00000000030E4000-memory.dmp
                • memory/1564-13-0x0000000000400000-0x0000000000554000-memory.dmp
                • memory/1564-12-0x0000000076101000-0x0000000076103000-memory.dmp
                • memory/1564-11-0x0000000000405CE2-mapping.dmp
                • memory/1564-10-0x0000000000400000-0x0000000000554000-memory.dmp