Analysis
-
max time kernel
17s -
max time network
137s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
07-04-2021 07:07
Static task
static1
Behavioral task
behavioral1
Sample
New Orders.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
New Orders.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
New Orders.exe
-
Size
64KB
-
MD5
d507f6899284562b5cab349e1082c297
-
SHA1
04f6718483f0590119e56edbb73420fa5431c9d5
-
SHA256
c44cd8ef8c5361ab56ad3d6fbf4d8eab7f531f9e12480626a461f4de8e4e827a
-
SHA512
0f6c8f84396224d0914d197dbedbf04e47f079e866bf5116f4d910e0c21a3b2d70cfeeb7c53b23650af683bcd796fb0204bff9cc2ca5e1d06a57f571d94ffb6a
Score
10/10
Malware Config
Extracted
Family
warzonerat
C2
104.209.133.4:7500
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/204-9-0x0000000000400000-0x0000000000555000-memory.dmp warzonerat behavioral2/memory/204-10-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/204-11-0x0000000000400000-0x0000000000555000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
New Orders.exedescription pid process target process PID 3116 set thread context of 204 3116 New Orders.exe New Orders.exe -
Processes:
New Orders.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 New Orders.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b060105050703086200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c14000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 New Orders.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 5c000000010000000400000000080000190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f6200000001000000200000003e9099b5015e8f486c00bcea9d111ee721faba355a89bcf1df69561e3dc6325c090000000100000034000000303206082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030106082b06010505070308530000000100000040000000303e301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c00f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa604000000010000001000000087ce0b7b2a0e4900e158719b37a893722000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 New Orders.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
New Orders.exedescription pid process Token: SeDebugPrivilege 3116 New Orders.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
New Orders.exedescription pid process target process PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe PID 3116 wrote to memory of 204 3116 New Orders.exe New Orders.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Orders.exe"C:\Users\Admin\AppData\Local\Temp\New Orders.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Orders.exe"C:\Users\Admin\AppData\Local\Temp\New Orders.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/204-9-0x0000000000400000-0x0000000000555000-memory.dmpFilesize
1.3MB
-
memory/204-10-0x0000000000405CE2-mapping.dmp
-
memory/204-11-0x0000000000400000-0x0000000000555000-memory.dmpFilesize
1.3MB
-
memory/3116-2-0x0000000073840000-0x0000000073F2E000-memory.dmpFilesize
6.9MB
-
memory/3116-3-0x0000000000CC0000-0x0000000000CC1000-memory.dmpFilesize
4KB
-
memory/3116-5-0x0000000006510000-0x0000000006511000-memory.dmpFilesize
4KB
-
memory/3116-6-0x00000000067C0000-0x00000000067C1000-memory.dmpFilesize
4KB
-
memory/3116-7-0x0000000005D90000-0x0000000005DB5000-memory.dmpFilesize
148KB
-
memory/3116-8-0x0000000006D60000-0x0000000006D61000-memory.dmpFilesize
4KB