0001.exe

General
Target

0001.exe

Filesize

504KB

Completed

12-03-2021 20:15

Score
10 /10
MD5

dce40fe214b73d0e6404ee8d25510cd1

SHA1

e6b31b3b3c8ad95554f63415f66ae098632c5a34

SHA256

72e1816b0f9e1fb44f557dda6696b1596b8c61369e7e91e4e730de33646d4d72

Malware Config

Extracted

Family warzonerat
C2

79.134.225.26:3141

Signatures 7

Filter: none

Discovery
Persistence
  • WarzoneRat, AveMaria

    Description

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Suspicious use of SetThreadContext
    0001.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2604 set thread context of 325626040001.exe0001.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Creates scheduled task(s)
    schtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    2664schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    0001.exe

    Reported IOCs

    pidprocess
    26040001.exe
  • Suspicious use of AdjustPrivilegeToken
    0001.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege26040001.exe
  • Suspicious use of WriteProcessMemory
    0001.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2604 wrote to memory of 266426040001.exeschtasks.exe
    PID 2604 wrote to memory of 266426040001.exeschtasks.exe
    PID 2604 wrote to memory of 266426040001.exeschtasks.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
    PID 2604 wrote to memory of 325626040001.exe0001.exe
Processes 3
  • C:\Users\Admin\AppData\Local\Temp\0001.exe
    "C:\Users\Admin\AppData\Local\Temp\0001.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2604
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tGzTHNLfnLr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCBA2.tmp"
      Creates scheduled task(s)
      PID:2664
    • C:\Users\Admin\AppData\Local\Temp\0001.exe
      "{path}"
      PID:3256
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Admin\AppData\Local\Temp\tmpCBA2.tmp

                        MD5

                        87a5eb355754a666b0d2812b2e8d1342

                        SHA1

                        60040ad29046330c52b6b762441bc4099d0c7420

                        SHA256

                        bf8a40c393cdee257ff1d78a5ff0640e41f86f6479e1643bec640a0029aa6737

                        SHA512

                        d10179b2180bebe1462f59cb69f7c536eb7086b5a29e52e00536b91f6bedcfbba95adda37f9680ddd781d1342293cc605acaefd59016efcbe23371b00c962d30

                      • memory/2604-2-0x0000000073940000-0x000000007402E000-memory.dmp

                      • memory/2604-5-0x0000000005400000-0x0000000005401000-memory.dmp

                      • memory/2604-6-0x0000000004F00000-0x0000000004F01000-memory.dmp

                      • memory/2604-7-0x00000000050D0000-0x00000000050D1000-memory.dmp

                      • memory/2604-8-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                      • memory/2604-9-0x00000000085C0000-0x00000000085C1000-memory.dmp

                      • memory/2604-10-0x000000007E430000-0x000000007E431000-memory.dmp

                      • memory/2604-11-0x0000000008780000-0x0000000008782000-memory.dmp

                      • memory/2604-12-0x0000000006BB0000-0x0000000006C24000-memory.dmp

                      • memory/2604-13-0x0000000006C30000-0x0000000006C63000-memory.dmp

                      • memory/2604-3-0x00000000005F0000-0x00000000005F1000-memory.dmp

                      • memory/2664-14-0x0000000000000000-mapping.dmp

                      • memory/3256-16-0x0000000000400000-0x000000000055E000-memory.dmp

                      • memory/3256-17-0x0000000000405E28-mapping.dmp

                      • memory/3256-18-0x0000000000400000-0x000000000055E000-memory.dmp