Analysis
-
max time kernel
147s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
07-05-2021 11:52
Static task
static1
Behavioral task
behavioral1
Sample
oder mcdq.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
oder mcdq.exe
Resource
win10v20210410
General
-
Target
oder mcdq.exe
-
Size
3.0MB
-
MD5
a46e5071e79ad0c6977059d8e7979b9b
-
SHA1
a0991039e331052b1ec81402a932ccfb7b9a2677
-
SHA256
3416c2ee1eb4d7c1e64b7bba4e336d5de068992d0a4b09c114ba574c057c2eb7
-
SHA512
b3b8e542b8c0d2f12689e28ee2956869b1ebdd0b4d5d6103972da1179bc87cea473cb5284643189592c03e015f4e7450eefd7609a1eb2c60b4d2ad3a4d4e1c0f
Malware Config
Extracted
warzonerat
193.169.255.128:2626
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3872-114-0x0000000002990000-0x0000000002AE4000-memory.dmp warzonerat behavioral2/memory/3872-119-0x0000000002D20000-0x0000000003820000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
Processes:
images.exepid process 1020 images.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
oder mcdq.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" oder mcdq.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
powershell.exepowershell.exepid process 1260 powershell.exe 1260 powershell.exe 1260 powershell.exe 3348 powershell.exe 3348 powershell.exe 3348 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1260 powershell.exe Token: SeDebugPrivilege 3348 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
oder mcdq.exeimages.exedescription pid process target process PID 3872 wrote to memory of 1260 3872 oder mcdq.exe powershell.exe PID 3872 wrote to memory of 1260 3872 oder mcdq.exe powershell.exe PID 3872 wrote to memory of 1260 3872 oder mcdq.exe powershell.exe PID 3872 wrote to memory of 1020 3872 oder mcdq.exe images.exe PID 3872 wrote to memory of 1020 3872 oder mcdq.exe images.exe PID 3872 wrote to memory of 1020 3872 oder mcdq.exe images.exe PID 1020 wrote to memory of 3348 1020 images.exe powershell.exe PID 1020 wrote to memory of 3348 1020 images.exe powershell.exe PID 1020 wrote to memory of 3348 1020 images.exe powershell.exe PID 1020 wrote to memory of 1900 1020 images.exe cmd.exe PID 1020 wrote to memory of 1900 1020 images.exe cmd.exe PID 1020 wrote to memory of 1900 1020 images.exe cmd.exe PID 1020 wrote to memory of 1900 1020 images.exe cmd.exe PID 1020 wrote to memory of 1900 1020 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\oder mcdq.exe"C:\Users\Admin\AppData\Local\Temp\oder mcdq.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeMD5
a46e5071e79ad0c6977059d8e7979b9b
SHA1a0991039e331052b1ec81402a932ccfb7b9a2677
SHA2563416c2ee1eb4d7c1e64b7bba4e336d5de068992d0a4b09c114ba574c057c2eb7
SHA512b3b8e542b8c0d2f12689e28ee2956869b1ebdd0b4d5d6103972da1179bc87cea473cb5284643189592c03e015f4e7450eefd7609a1eb2c60b4d2ad3a4d4e1c0f
-
C:\ProgramData\images.exeMD5
a46e5071e79ad0c6977059d8e7979b9b
SHA1a0991039e331052b1ec81402a932ccfb7b9a2677
SHA2563416c2ee1eb4d7c1e64b7bba4e336d5de068992d0a4b09c114ba574c057c2eb7
SHA512b3b8e542b8c0d2f12689e28ee2956869b1ebdd0b4d5d6103972da1179bc87cea473cb5284643189592c03e015f4e7450eefd7609a1eb2c60b4d2ad3a4d4e1c0f
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logMD5
1c19c16e21c97ed42d5beabc93391fc5
SHA18ad83f8e0b3acf8dfbbf87931e41f0d664c4df68
SHA2561bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05
SHA5127d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveMD5
4e4ebdd2504748866e703fec68af082d
SHA1aa90842033bc6c9639a294224fb2f1f63dc65b75
SHA256de08631b7c6b7b187b98159184574c4dd559b3f6f74dcfa370ed58a220b47240
SHA512f0935863fae93781791ed0633b3fa656715581feb1474d52c78d263c4dab22da170db40fc6fb20eb507e80f63396c15f412138086a7e89ec6dd0ad7d4ce89209
-
memory/1020-121-0x0000000000000000-mapping.dmp
-
memory/1260-134-0x0000000007580000-0x0000000007581000-memory.dmpFilesize
4KB
-
memory/1260-151-0x0000000008B10000-0x0000000008B11000-memory.dmpFilesize
4KB
-
memory/1260-127-0x0000000006C70000-0x0000000006C71000-memory.dmpFilesize
4KB
-
memory/1260-128-0x0000000007310000-0x0000000007311000-memory.dmpFilesize
4KB
-
memory/1260-129-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB
-
memory/1260-131-0x0000000000E72000-0x0000000000E73000-memory.dmpFilesize
4KB
-
memory/1260-132-0x00000000073C0000-0x00000000073C1000-memory.dmpFilesize
4KB
-
memory/1260-130-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/1260-133-0x0000000007700000-0x0000000007701000-memory.dmpFilesize
4KB
-
memory/1260-120-0x0000000000000000-mapping.dmp
-
memory/1260-135-0x0000000007ED0000-0x0000000007ED1000-memory.dmpFilesize
4KB
-
memory/1260-136-0x0000000007D20000-0x0000000007D21000-memory.dmpFilesize
4KB
-
memory/1260-144-0x0000000008B30000-0x0000000008B63000-memory.dmpFilesize
204KB
-
memory/1260-126-0x0000000000E10000-0x0000000000E11000-memory.dmpFilesize
4KB
-
memory/1260-156-0x0000000008E70000-0x0000000008E71000-memory.dmpFilesize
4KB
-
memory/1260-157-0x000000007E3F0000-0x000000007E3F1000-memory.dmpFilesize
4KB
-
memory/1260-158-0x0000000009030000-0x0000000009031000-memory.dmpFilesize
4KB
-
memory/1260-175-0x0000000000E73000-0x0000000000E74000-memory.dmpFilesize
4KB
-
memory/1900-189-0x0000000000000000-mapping.dmp
-
memory/3348-188-0x0000000000000000-mapping.dmp
-
memory/3348-192-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/3348-193-0x0000000000D92000-0x0000000000D93000-memory.dmpFilesize
4KB
-
memory/3348-194-0x000000007E0C0000-0x000000007E0C1000-memory.dmpFilesize
4KB
-
memory/3348-195-0x0000000000D93000-0x0000000000D94000-memory.dmpFilesize
4KB
-
memory/3872-114-0x0000000002990000-0x0000000002AE4000-memory.dmpFilesize
1.3MB
-
memory/3872-119-0x0000000002D20000-0x0000000003820000-memory.dmpFilesize
11.0MB