Analysis
-
max time kernel
64s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
01-07-2021 12:28
Static task
static1
Behavioral task
behavioral1
Sample
JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe
Resource
win10v20210410
General
-
Target
JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe
-
Size
782KB
-
MD5
851835c0488a22e389e2ce7793f3cb02
-
SHA1
afb6572bc1e6e2f0a76a677bca60b146f50d3bd7
-
SHA256
8a1ceb6687babe6ab82a38ca344d1092a7fc9bd6dbaf3420a3311c50131928ef
-
SHA512
60fc9ffca1f2790288bb9dd60ca4a8a5eaff42a48f5a5c6ccb59efb319be862af0b699e71a7d0522cb24a5b36dcd8b9c783d31c7eadee0ebdae9b6e5df836e8e
Malware Config
Extracted
warzonerat
13.82.24.228:5918
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3676-127-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/3676-126-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/3676-128-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exedescription pid process target process PID 3416 set thread context of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exedescription pid process target process PID 3416 wrote to memory of 3096 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe schtasks.exe PID 3416 wrote to memory of 3096 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe schtasks.exe PID 3416 wrote to memory of 3096 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe schtasks.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe PID 3416 wrote to memory of 3676 3416 JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WINOrJPgVkjJzB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB0.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe"C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K.- Purchase Order 19600396 & 19600397.xlsx.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpFB0.tmpMD5
c5a1a5d639ff902378a1f1eaadf89332
SHA1de4d6bda2d094c0ffdf93c7cc82c7ec2deb82d26
SHA256948ff215c3ae8a66d5e59e3344a74bffeabaf8a0c3df9c915f9c8ed4c83a097f
SHA512283c16ac77f068619fd0ca5b61019ad378025b25d844df740df88f360b6d408be6aa45c2a608ec711a83f9382e069a6970153fa8e1cc5d360b9fe91bed5bf8dd
-
memory/3096-124-0x0000000000000000-mapping.dmp
-
memory/3416-118-0x0000000004DA0000-0x0000000004DA1000-memory.dmpFilesize
4KB
-
memory/3416-114-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/3416-119-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/3416-120-0x0000000004D00000-0x00000000051FE000-memory.dmpFilesize
5.0MB
-
memory/3416-121-0x000000000A400000-0x000000000C3FF000-memory.dmpFilesize
32.0MB
-
memory/3416-122-0x0000000000BF0000-0x0000000000C58000-memory.dmpFilesize
416KB
-
memory/3416-123-0x0000000000CA0000-0x0000000000CCC000-memory.dmpFilesize
176KB
-
memory/3416-117-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/3416-116-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/3676-127-0x0000000000405CE2-mapping.dmp
-
memory/3676-126-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/3676-128-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB