Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
07-05-2021 12:01
Static task
static1
Behavioral task
behavioral1
Sample
oder mcdq.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
oder mcdq.exe
Resource
win10v20210408
General
-
Target
oder mcdq.exe
-
Size
3.0MB
-
MD5
a46e5071e79ad0c6977059d8e7979b9b
-
SHA1
a0991039e331052b1ec81402a932ccfb7b9a2677
-
SHA256
3416c2ee1eb4d7c1e64b7bba4e336d5de068992d0a4b09c114ba574c057c2eb7
-
SHA512
b3b8e542b8c0d2f12689e28ee2956869b1ebdd0b4d5d6103972da1179bc87cea473cb5284643189592c03e015f4e7450eefd7609a1eb2c60b4d2ad3a4d4e1c0f
Malware Config
Extracted
warzonerat
193.169.255.128:2626
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/812-114-0x0000000003160000-0x0000000003C60000-memory.dmp warzonerat behavioral2/memory/812-115-0x0000000002DD0000-0x0000000002F24000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
Processes:
images.exepid process 4016 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
oder mcdq.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" oder mcdq.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 2276 powershell.exe 2276 powershell.exe 2276 powershell.exe 1904 powershell.exe 1904 powershell.exe 1904 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 2276 powershell.exe Token: SeDebugPrivilege 1904 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
oder mcdq.exeimages.exedescription pid process target process PID 812 wrote to memory of 2276 812 oder mcdq.exe powershell.exe PID 812 wrote to memory of 2276 812 oder mcdq.exe powershell.exe PID 812 wrote to memory of 2276 812 oder mcdq.exe powershell.exe PID 812 wrote to memory of 4016 812 oder mcdq.exe images.exe PID 812 wrote to memory of 4016 812 oder mcdq.exe images.exe PID 812 wrote to memory of 4016 812 oder mcdq.exe images.exe PID 4016 wrote to memory of 1904 4016 images.exe powershell.exe PID 4016 wrote to memory of 1904 4016 images.exe powershell.exe PID 4016 wrote to memory of 1904 4016 images.exe powershell.exe PID 4016 wrote to memory of 1148 4016 images.exe cmd.exe PID 4016 wrote to memory of 1148 4016 images.exe cmd.exe PID 4016 wrote to memory of 1148 4016 images.exe cmd.exe PID 4016 wrote to memory of 1148 4016 images.exe cmd.exe PID 4016 wrote to memory of 1148 4016 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\oder mcdq.exe"C:\Users\Admin\AppData\Local\Temp\oder mcdq.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeMD5
a46e5071e79ad0c6977059d8e7979b9b
SHA1a0991039e331052b1ec81402a932ccfb7b9a2677
SHA2563416c2ee1eb4d7c1e64b7bba4e336d5de068992d0a4b09c114ba574c057c2eb7
SHA512b3b8e542b8c0d2f12689e28ee2956869b1ebdd0b4d5d6103972da1179bc87cea473cb5284643189592c03e015f4e7450eefd7609a1eb2c60b4d2ad3a4d4e1c0f
-
C:\ProgramData\images.exeMD5
a46e5071e79ad0c6977059d8e7979b9b
SHA1a0991039e331052b1ec81402a932ccfb7b9a2677
SHA2563416c2ee1eb4d7c1e64b7bba4e336d5de068992d0a4b09c114ba574c057c2eb7
SHA512b3b8e542b8c0d2f12689e28ee2956869b1ebdd0b4d5d6103972da1179bc87cea473cb5284643189592c03e015f4e7450eefd7609a1eb2c60b4d2ad3a4d4e1c0f
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
66fd65b7acca90c263de08a52610c797
SHA15f0cbdedf564211b8d9cbb8bc88e08ad75d3ad2f
SHA2568b9e2d7c73d684081d5c698f2db5273f9e9fe45fc17b61df9b152b98289edfe6
SHA512f0fc9bfcea1d2da6959acbc291c3cdecb2038240c9132576fc1e3f98e51c8d2d2c83b5ee09581aeeab994d8ed102df980876aba0ffbb8af4c1866db8564c1e56
-
memory/812-114-0x0000000003160000-0x0000000003C60000-memory.dmpFilesize
11.0MB
-
memory/812-115-0x0000000002DD0000-0x0000000002F24000-memory.dmpFilesize
1.3MB
-
memory/1148-189-0x0000000000000000-mapping.dmp
-
memory/1904-195-0x0000000006C43000-0x0000000006C44000-memory.dmpFilesize
4KB
-
memory/1904-194-0x000000007F240000-0x000000007F241000-memory.dmpFilesize
4KB
-
memory/1904-192-0x0000000006C42000-0x0000000006C43000-memory.dmpFilesize
4KB
-
memory/1904-191-0x0000000006C40000-0x0000000006C41000-memory.dmpFilesize
4KB
-
memory/1904-188-0x0000000000000000-mapping.dmp
-
memory/2276-134-0x00000000080F0000-0x00000000080F1000-memory.dmpFilesize
4KB
-
memory/2276-158-0x00000000096B0000-0x00000000096B1000-memory.dmpFilesize
4KB
-
memory/2276-132-0x0000000007A50000-0x0000000007A51000-memory.dmpFilesize
4KB
-
memory/2276-135-0x0000000008410000-0x0000000008411000-memory.dmpFilesize
4KB
-
memory/2276-136-0x0000000008460000-0x0000000008461000-memory.dmpFilesize
4KB
-
memory/2276-144-0x00000000091B0000-0x00000000091E3000-memory.dmpFilesize
204KB
-
memory/2276-152-0x0000000009190000-0x0000000009191000-memory.dmpFilesize
4KB
-
memory/2276-151-0x000000007FB30000-0x000000007FB31000-memory.dmpFilesize
4KB
-
memory/2276-157-0x00000000092F0000-0x00000000092F1000-memory.dmpFilesize
4KB
-
memory/2276-133-0x0000000007CA0000-0x0000000007CA1000-memory.dmpFilesize
4KB
-
memory/2276-173-0x0000000006D33000-0x0000000006D34000-memory.dmpFilesize
4KB
-
memory/2276-131-0x0000000007C30000-0x0000000007C31000-memory.dmpFilesize
4KB
-
memory/2276-130-0x0000000007260000-0x0000000007261000-memory.dmpFilesize
4KB
-
memory/2276-129-0x0000000006D32000-0x0000000006D33000-memory.dmpFilesize
4KB
-
memory/2276-128-0x0000000006D30000-0x0000000006D31000-memory.dmpFilesize
4KB
-
memory/2276-127-0x0000000007370000-0x0000000007371000-memory.dmpFilesize
4KB
-
memory/2276-126-0x0000000006C60000-0x0000000006C61000-memory.dmpFilesize
4KB
-
memory/2276-120-0x0000000000000000-mapping.dmp
-
memory/4016-121-0x0000000000000000-mapping.dmp