Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
23-07-2021 17:03
Static task
static1
Behavioral task
behavioral1
Sample
Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe
Resource
win10v20210408
General
-
Target
Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe
-
Size
1.1MB
-
MD5
6a0d38e42f95094a525a824ea5005766
-
SHA1
7dd0300cf123743cea7620e97a767d707190c08e
-
SHA256
e8c59da246fccfab27b1e04e4d2bae1f222e845c9573b7b0c5f01d90aa76a3a3
-
SHA512
3ac25e8931d7b17782edafb349144d192b29d3a5d920e38da9168347b636d3fb7e07fb6725a4e6c1a6d78c2a3db023bfca73c28489599d9d27fa4c0ba77ad445
Malware Config
Extracted
warzonerat
79.134.225.8:8654
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
mobsync.exepid process 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe 1820 mobsync.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Explorer.EXEdescription pid process Token: SeShutdownPrivilege 3024 Explorer.EXE Token: SeCreatePagefilePrivilege 3024 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exemobsync.exedescription pid process target process PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 664 wrote to memory of 1820 664 Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe mobsync.exe PID 1820 wrote to memory of 3024 1820 mobsync.exe Explorer.EXE PID 1820 wrote to memory of 3024 1820 mobsync.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
-
C:\Users\Admin\AppData\Local\Temp\Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe"C:\Users\Admin\AppData\Local\Temp\Resumen detallado del proveedor de 1302640 de solicitud de presupuesto.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mobsync.exeC:\Windows\System32\mobsync.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/664-114-0x0000000000520000-0x00000000005CE000-memory.dmpFilesize
696KB
-
memory/664-116-0x00000000006E0000-0x00000000006FA000-memory.dmpFilesize
104KB
-
memory/1820-119-0x0000000000000000-mapping.dmp
-
memory/1820-121-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/1820-120-0x00000000009A0000-0x00000000009A1000-memory.dmpFilesize
4KB
-
memory/1820-122-0x0000000010670000-0x00000000107D0000-memory.dmpFilesize
1.4MB
-
memory/1820-123-0x00000000008E0000-0x00000000008E1000-memory.dmpFilesize
4KB
-
memory/1820-124-0x00000000042D0000-0x000000000442E000-memory.dmpFilesize
1.4MB
-
memory/3024-125-0x0000000002370000-0x0000000002376000-memory.dmpFilesize
24KB
-
memory/3024-129-0x0000000004EA0000-0x0000000004FA0000-memory.dmpFilesize
1024KB
-
memory/3024-131-0x00000000023A0000-0x00000000023A1000-memory.dmpFilesize
4KB
-
memory/3024-130-0x00007FFB6C620000-0x00007FFB6C630000-memory.dmpFilesize
64KB
-
memory/3024-132-0x00007FFB6C640000-0x00007FFB6C646000-memory.dmpFilesize
24KB
-
memory/3024-133-0x0000000002380000-0x0000000002381000-memory.dmpFilesize
4KB