Analysis
-
max time kernel
148s -
max time network
197s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-07-2021 11:05
Static task
static1
Behavioral task
behavioral1
Sample
QUOTATION-007222021.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
QUOTATION-007222021.exe
Resource
win10v20210410
General
-
Target
QUOTATION-007222021.exe
-
Size
3.0MB
-
MD5
4b25ce6286e4db04124b13ad0227fd77
-
SHA1
53ce201bab5c1de3ab8ce4bf2a89eec54fa25a05
-
SHA256
4d787dca4719a668ec0cca721a93a2ae6b6135a2ddde4f75f2b8b790fb19cc3b
-
SHA512
d245418614f02e6aefc59e9fa24a82827a09bc0150e89b1ff21e89c4c75d75bf14527ec0b8720e5ecce80b5ab8b1651c14b15d0c7786c0c47d123e8c5cd0bdc3
Malware Config
Extracted
warzonerat
194.5.97.145:9976
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1208-60-0x00000000009C0000-0x0000000000B14000-memory.dmp warzonerat behavioral1/memory/1208-65-0x00000000027C0000-0x00000000032C0000-memory.dmp warzonerat behavioral1/memory/1628-70-0x0000000002020000-0x0000000002174000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
Processes:
images.exepid process 1628 images.exe -
Loads dropped DLL 1 IoCs
Processes:
QUOTATION-007222021.exepid process 1208 QUOTATION-007222021.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
QUOTATION-007222021.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" QUOTATION-007222021.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
QUOTATION-007222021.exeimages.exedescription pid process target process PID 1208 wrote to memory of 1628 1208 QUOTATION-007222021.exe images.exe PID 1208 wrote to memory of 1628 1208 QUOTATION-007222021.exe images.exe PID 1208 wrote to memory of 1628 1208 QUOTATION-007222021.exe images.exe PID 1208 wrote to memory of 1628 1208 QUOTATION-007222021.exe images.exe PID 1628 wrote to memory of 960 1628 images.exe cmd.exe PID 1628 wrote to memory of 960 1628 images.exe cmd.exe PID 1628 wrote to memory of 960 1628 images.exe cmd.exe PID 1628 wrote to memory of 960 1628 images.exe cmd.exe PID 1628 wrote to memory of 960 1628 images.exe cmd.exe PID 1628 wrote to memory of 960 1628 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTATION-007222021.exe"C:\Users\Admin\AppData\Local\Temp\QUOTATION-007222021.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeMD5
4b25ce6286e4db04124b13ad0227fd77
SHA153ce201bab5c1de3ab8ce4bf2a89eec54fa25a05
SHA2564d787dca4719a668ec0cca721a93a2ae6b6135a2ddde4f75f2b8b790fb19cc3b
SHA512d245418614f02e6aefc59e9fa24a82827a09bc0150e89b1ff21e89c4c75d75bf14527ec0b8720e5ecce80b5ab8b1651c14b15d0c7786c0c47d123e8c5cd0bdc3
-
C:\ProgramData\images.exeMD5
4b25ce6286e4db04124b13ad0227fd77
SHA153ce201bab5c1de3ab8ce4bf2a89eec54fa25a05
SHA2564d787dca4719a668ec0cca721a93a2ae6b6135a2ddde4f75f2b8b790fb19cc3b
SHA512d245418614f02e6aefc59e9fa24a82827a09bc0150e89b1ff21e89c4c75d75bf14527ec0b8720e5ecce80b5ab8b1651c14b15d0c7786c0c47d123e8c5cd0bdc3
-
\ProgramData\images.exeMD5
4b25ce6286e4db04124b13ad0227fd77
SHA153ce201bab5c1de3ab8ce4bf2a89eec54fa25a05
SHA2564d787dca4719a668ec0cca721a93a2ae6b6135a2ddde4f75f2b8b790fb19cc3b
SHA512d245418614f02e6aefc59e9fa24a82827a09bc0150e89b1ff21e89c4c75d75bf14527ec0b8720e5ecce80b5ab8b1651c14b15d0c7786c0c47d123e8c5cd0bdc3
-
memory/960-76-0x0000000000000000-mapping.dmp
-
memory/960-77-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/1208-59-0x0000000076661000-0x0000000076663000-memory.dmpFilesize
8KB
-
memory/1208-60-0x00000000009C0000-0x0000000000B14000-memory.dmpFilesize
1.3MB
-
memory/1208-65-0x00000000027C0000-0x00000000032C0000-memory.dmpFilesize
11.0MB
-
memory/1628-67-0x0000000000000000-mapping.dmp
-
memory/1628-70-0x0000000002020000-0x0000000002174000-memory.dmpFilesize
1.3MB