Analysis
-
max time kernel
111s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
13-07-2021 19:14
Static task
static1
Behavioral task
behavioral1
Sample
New Order_R43YZIr0C8E62iK.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
New Order_R43YZIr0C8E62iK.exe
Resource
win10v20210410
General
-
Target
New Order_R43YZIr0C8E62iK.exe
-
Size
291KB
-
MD5
c2defdcd91b04ece9e34bee77d0f5adc
-
SHA1
14b0616035e2fef2c4dc9ab4ba9b5f23b159c361
-
SHA256
344411537546f4601fe7f667f8cd82cb0aa92da98581ea055b66d49ed16ebd89
-
SHA512
41665255975bf4a392f50455b7640e77e42ee1aa505a60fa4d5b620d9ce4193832362d6159193319a0029109f6602b0ef7f78fbf20de667f773efd67b5e08c25
Malware Config
Extracted
warzonerat
185.105.236.179:1975
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 6 IoCs
Processes:
resource yara_rule behavioral2/memory/3332-116-0x0000000000405887-mapping.dmp warzonerat behavioral2/memory/3332-115-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/3332-117-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral2/memory/3588-123-0x0000000000405887-mapping.dmp warzonerat behavioral2/memory/3588-125-0x0000000000590000-0x00000000005AD000-memory.dmp warzonerat behavioral2/memory/3588-130-0x0000000000590000-0x00000000005AD000-memory.dmp warzonerat -
Executes dropped EXE 2 IoCs
Processes:
User1.exeUser1.exepid process 3488 User1.exe 3588 User1.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exeUser1.exedescription pid process target process PID 3904 set thread context of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3488 set thread context of 3588 3488 User1.exe User1.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1164 3588 WerFault.exe User1.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exeUser1.exeWerFault.exepid process 3904 New Order_R43YZIr0C8E62iK.exe 3904 New Order_R43YZIr0C8E62iK.exe 3488 User1.exe 3488 User1.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe 1164 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exeUser1.exeWerFault.exedescription pid process Token: SeDebugPrivilege 3904 New Order_R43YZIr0C8E62iK.exe Token: SeDebugPrivilege 3488 User1.exe Token: SeRestorePrivilege 1164 WerFault.exe Token: SeBackupPrivilege 1164 WerFault.exe Token: SeDebugPrivilege 1164 WerFault.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
New Order_R43YZIr0C8E62iK.exeNew Order_R43YZIr0C8E62iK.exeUser1.exedescription pid process target process PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3904 wrote to memory of 3332 3904 New Order_R43YZIr0C8E62iK.exe New Order_R43YZIr0C8E62iK.exe PID 3332 wrote to memory of 3488 3332 New Order_R43YZIr0C8E62iK.exe User1.exe PID 3332 wrote to memory of 3488 3332 New Order_R43YZIr0C8E62iK.exe User1.exe PID 3332 wrote to memory of 3488 3332 New Order_R43YZIr0C8E62iK.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe PID 3488 wrote to memory of 3588 3488 User1.exe User1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"C:\Users\Admin\AppData\Local\Temp\New Order_R43YZIr0C8E62iK.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\User1.exe"C:\ProgramData\User1.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\User1.exe"C:\ProgramData\User1.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 5085⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\User1.exeMD5
c2defdcd91b04ece9e34bee77d0f5adc
SHA114b0616035e2fef2c4dc9ab4ba9b5f23b159c361
SHA256344411537546f4601fe7f667f8cd82cb0aa92da98581ea055b66d49ed16ebd89
SHA51241665255975bf4a392f50455b7640e77e42ee1aa505a60fa4d5b620d9ce4193832362d6159193319a0029109f6602b0ef7f78fbf20de667f773efd67b5e08c25
-
C:\ProgramData\User1.exeMD5
c2defdcd91b04ece9e34bee77d0f5adc
SHA114b0616035e2fef2c4dc9ab4ba9b5f23b159c361
SHA256344411537546f4601fe7f667f8cd82cb0aa92da98581ea055b66d49ed16ebd89
SHA51241665255975bf4a392f50455b7640e77e42ee1aa505a60fa4d5b620d9ce4193832362d6159193319a0029109f6602b0ef7f78fbf20de667f773efd67b5e08c25
-
C:\ProgramData\User1.exeMD5
c2defdcd91b04ece9e34bee77d0f5adc
SHA114b0616035e2fef2c4dc9ab4ba9b5f23b159c361
SHA256344411537546f4601fe7f667f8cd82cb0aa92da98581ea055b66d49ed16ebd89
SHA51241665255975bf4a392f50455b7640e77e42ee1aa505a60fa4d5b620d9ce4193832362d6159193319a0029109f6602b0ef7f78fbf20de667f773efd67b5e08c25
-
memory/3332-116-0x0000000000405887-mapping.dmp
-
memory/3332-115-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3332-117-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/3488-118-0x0000000000000000-mapping.dmp
-
memory/3488-121-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB
-
memory/3588-123-0x0000000000405887-mapping.dmp
-
memory/3588-125-0x0000000000590000-0x00000000005AD000-memory.dmpFilesize
116KB
-
memory/3588-130-0x0000000000590000-0x00000000005AD000-memory.dmpFilesize
116KB
-
memory/3904-114-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB