Overview

overview

10

Static

static

Purchase O...07.exe

windows7_x64

3

Purchase O...07.exe

windows10_x64

10

Analysis

  • max time kernel
    122s
  • max time network
    141s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    26/05/2021, 17:39

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Purchase Orders - Foreign_000000000088707.exe
  • Size 449KB
  • Sample210526-b2dvwackpa
  • SHA256 f4be91d5771599ee3f80dd26990d324c291e4b327db563c15379b09ffa79eadb
  • MD5 SHA1 SHA512
Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

  • warzonerat

C2

  • 157.55.136.23:5300

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzone RAT Payload 3 IoCs
    rat
  • Downloads MZ/PE file
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe
    "C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4444
    • C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe
      "C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe"
      2⤵
        PID:4208
      • C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe
        "C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe"
        2⤵
          PID:4220
        • C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe
          "C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe"
          2⤵
            PID:4196
          • C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe
            "C:\Users\Admin\AppData\Local\Temp\Purchase Orders - Foreign_000000000088707.exe"
            2⤵
              PID:4156

          Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                memory/4156-126-0x0000000000400000-0x0000000000554000-memory.dmp
                Download

                memory/4156-128-0x0000000000400000-0x0000000000554000-memory.dmp
                Download

                memory/4444-114-0x0000000000D40000-0x0000000000D41000-memory.dmp
                Download

                memory/4444-116-0x0000000005780000-0x0000000005781000-memory.dmp
                Download

                memory/4444-117-0x0000000005770000-0x0000000005780000-memory.dmp
                Download

                memory/4444-122-0x0000000006160000-0x00000000061AD000-memory.dmp
                Download

                memory/4444-125-0x0000000006630000-0x0000000006631000-memory.dmp
                Download