Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
08-07-2021 09:16
Static task
static1
Behavioral task
behavioral1
Sample
PL-PB39-210706.bin.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
PL-PB39-210706.bin.exe
Resource
win10v20210408
General
-
Target
PL-PB39-210706.bin.exe
-
Size
715KB
-
MD5
1e319708c4a19328d77d69194cd38825
-
SHA1
7a32f59a929f8980c3f6978bb61c9607d8d1b636
-
SHA256
698af940b3ff533826faf92c237801109ded9a8fa32ca6ff50d5f33dc002c98c
-
SHA512
5b4f0b09e32bf89911ee54519683306fbcb208d3a158c80c0af77fa8be4a007a30eba4e2a71e2b94bfccf6b355411a738f862ad503cf5e14fbb44dfe20129654
Malware Config
Extracted
warzonerat
sipex2021.ddns.net:6397
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
PL-PB39-210706.bin.exedescription pid process target process PID 1240 set thread context of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
PL-PB39-210706.bin.exeMSBuild.exepid process 1240 PL-PB39-210706.bin.exe 1240 PL-PB39-210706.bin.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe 868 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PL-PB39-210706.bin.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1240 PL-PB39-210706.bin.exe Token: SeShutdownPrivilege 1216 Explorer.EXE -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
PL-PB39-210706.bin.exeMSBuild.exedescription pid process target process PID 1240 wrote to memory of 924 1240 PL-PB39-210706.bin.exe schtasks.exe PID 1240 wrote to memory of 924 1240 PL-PB39-210706.bin.exe schtasks.exe PID 1240 wrote to memory of 924 1240 PL-PB39-210706.bin.exe schtasks.exe PID 1240 wrote to memory of 924 1240 PL-PB39-210706.bin.exe schtasks.exe PID 1240 wrote to memory of 616 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 616 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 616 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 616 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 1240 wrote to memory of 868 1240 PL-PB39-210706.bin.exe MSBuild.exe PID 868 wrote to memory of 1216 868 MSBuild.exe Explorer.EXE PID 868 wrote to memory of 1216 868 MSBuild.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\PL-PB39-210706.bin.exe"C:\Users\Admin\AppData\Local\Temp\PL-PB39-210706.bin.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\yvPEuzi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE179.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpE179.tmpMD5
4df0a06d003d077bf7efa37c012d8ba3
SHA155bbc4fce9e34abf97a77025a094fec82f2e04ef
SHA256f4a4a07e9a066403844dcc2afdebad532a237f2c09b6daabe257a0087865b65d
SHA512c285716904f65b5cc1001df0766b85000bbe14f49e5db59ff38d2afb82624c94f39cfbc3faf03a280cfb59cee18140b3e837cc46e770108e89007a9a32b5ed87
-
memory/868-69-0x00000000752B1000-0x00000000752B3000-memory.dmpFilesize
8KB
-
memory/868-68-0x0000000000405E28-mapping.dmp
-
memory/868-67-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/868-70-0x0000000000400000-0x000000000055E000-memory.dmpFilesize
1.4MB
-
memory/924-65-0x0000000000000000-mapping.dmp
-
memory/1216-71-0x0000000003750000-0x0000000003756000-memory.dmpFilesize
24KB
-
memory/1216-75-0x0000000004B50000-0x0000000004C50000-memory.dmpFilesize
1024KB
-
memory/1240-62-0x00000000002A0000-0x00000000002AF000-memory.dmpFilesize
60KB
-
memory/1240-63-0x0000000006010000-0x0000000006082000-memory.dmpFilesize
456KB
-
memory/1240-64-0x00000000004D0000-0x000000000050B000-memory.dmpFilesize
236KB
-
memory/1240-61-0x0000000004A20000-0x0000000004A21000-memory.dmpFilesize
4KB
-
memory/1240-59-0x0000000000160000-0x0000000000161000-memory.dmpFilesize
4KB