Urgent_request_for_quotation.exe

General
Target

Urgent_request_for_quotation.exe

Filesize

736KB

Completed

22-07-2021 08:47

Score
10 /10
MD5

392c8ecd4e0adeffe68d8365a4834bc1

SHA1

7e84b2d4cb21efa0324c956ff7f7d5c12fbb586f

SHA256

6cd9680a21d7f13a34e111c1f9e645b1b657b8b7e13ce16deddfee2b003f7579

Malware Config

Extracted

Family warzonerat
C2

79.134.225.8:8654

Signatures 2

Filter: none

  • WarzoneRat, AveMaria

    Description

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Suspicious use of WriteProcessMemory
    Urgent_request_for_quotation.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
    PID 1856 wrote to memory of 18921856Urgent_request_for_quotation.exeieinstal.exe
Processes 2
  • C:\Users\Admin\AppData\Local\Temp\Urgent_request_for_quotation.exe
    "C:\Users\Admin\AppData\Local\Temp\Urgent_request_for_quotation.exe"
    Suspicious use of WriteProcessMemory
    PID:1856
    • C:\Program Files (x86)\internet explorer\ieinstal.exe
      "C:\Program Files (x86)\internet explorer\ieinstal.exe"
      PID:1892
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Discovery
            Execution
              Exfiltration
                Impact
                  Initial Access
                    Lateral Movement
                      Persistence
                        Privilege Escalation
                          Replay Monitor
                          00:00 00:00
                          Downloads
                          • memory/1856-60-0x00000000752B1000-0x00000000752B3000-memory.dmp

                          • memory/1856-61-0x0000000000330000-0x0000000000331000-memory.dmp

                          • memory/1892-62-0x0000000000000000-mapping.dmp

                          • memory/1892-65-0x0000000000180000-0x0000000000181000-memory.dmp

                          • memory/1892-64-0x00000000000D0000-0x00000000000D1000-memory.dmp

                          • memory/1892-67-0x0000000000AB0000-0x0000000000C0E000-memory.dmp

                          • memory/1892-66-0x0000000010670000-0x00000000107D0000-memory.dmp

                          • memory/1892-68-0x0000000000090000-0x0000000000091000-memory.dmp