Analysis

  • max time kernel
    149s
  • max time network
    44s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    23-07-2021 09:35

General

  • Target

    Statement SKBMT 01578.exe

  • Size

    1.1MB

  • MD5

    b2cd4e8f0a79d8953255bef56fb15bb1

  • SHA1

    38f857bbc3bb63418fad5474b5b315ec8688144e

  • SHA256

    857dd518ef3c65847d22cec214d81cc0e2ca2259915a7308c0b2ff2c58023082

  • SHA512

    771a158731332e72c848a10ad87b928317cdc83026813e6651ffa173875182059580f1092d953f417974be18252ee7de19016ee9a65f6fbf16392ad0515ee010

Malware Config

Extracted

Family

warzonerat

C2

103.133.109.176:7600

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Statement SKBMT 01578.exe
    "C:\Users\Admin\AppData\Local\Temp\Statement SKBMT 01578.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1072
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Statement SKBMT 01578.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:980
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TEzhNHNZpEt.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1248
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TEzhNHNZpEt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBF97.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1808
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TEzhNHNZpEt.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1716
    • C:\Users\Admin\AppData\Local\Temp\Statement SKBMT 01578.exe
      "C:\Users\Admin\AppData\Local\Temp\Statement SKBMT 01578.exe"
      2⤵
        PID:1556

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Scheduled Task

    1
    T1053

    Discovery

    System Information Discovery

    1
    T1082

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_1602f747-c1a3-4345-8dec-4dcb8b1f72e5
      MD5

      02ff38ac870de39782aeee04d7b48231

      SHA1

      0390d39fa216c9b0ecdb38238304e518fb2b5095

      SHA256

      fbd66a9baf753db31b8de23f2d51b67f8676687503653103080c45b16f1dc876

      SHA512

      24a1ff76ee42ff7a5ea42843928c4df07b06178f7781cd840e1e086e88735d81506eb67259ff1e6ce5aaa7c5baea03886da265eb7e025ff4dc4c4b5f8cd3e341

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2d686436-375c-4ee1-bd4a-9e44ccd248ba
      MD5

      75a8da7754349b38d64c87c938545b1b

      SHA1

      5c28c257d51f1c1587e29164cc03ea880c21b417

      SHA256

      bf08151c174b5d00c9dbc7907b2c6a01b4be76bfa3afce1e8bd98a04ad833c96

      SHA512

      798797bc74c56c874e9a5fdcb0157c04e37a1b3cce285ef064b01bceef8cec45f11a5198918c6c647220b62883606b5e12e3cca3ea369f3a66e69dea6e15f643

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_4375eeb7-a65d-43f1-a616-02c5ad6c5370
      MD5

      be4d72095faf84233ac17b94744f7084

      SHA1

      cc78ce5b9c57573bd214a8f423ee622b00ebb1ec

      SHA256

      b0d72c5c22e57913476ac8fc686a4593f137c6667d5094522c0a0685dabd7adc

      SHA512

      43856e9b1032b8690ceea810c931bed3655e9190414bb220fb6afc136f31b8335e07604dffb28405d4006f266a54cff424c527d29924b1b732c9647a3252b097

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_6fe5bd95-2cea-4aea-9c8c-dd67bac4295b
      MD5

      df44874327d79bd75e4264cb8dc01811

      SHA1

      1396b06debed65ea93c24998d244edebd3c0209d

      SHA256

      55de642c5c9e436ec01c57004dae797022442c3245daf7162d19a5585f221181

      SHA512

      95dc9298b8db059bbe746f67e6a7f8515781c7053cc60c01532e47623a996be7e1bd23d1bd8f5f2045adff27454f44930d503c15b695690088841cedbd2a06c3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fa12b0a1-3d6a-4bab-a74a-253a75ca0598
      MD5

      5e3c7184a75d42dda1a83606a45001d8

      SHA1

      94ca15637721d88f30eb4b6220b805c5be0360ed

      SHA256

      8278033a65d1ff48be4d86e11f87930d187692f59f8bf2f0a9d170de285afb59

      SHA512

      fae99b6e9b106e0f1c30aa4082b25ae1ad643455c1295c2c16ad534e3e611b9b08492353ffe1af1cfdddc9b2b7c330747a64012c45e62b8f4a4982dcc214e05b

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fd9bf4da-ec38-4847-85c5-d50f35796d4c
      MD5

      a725bb9fafcf91f3c6b7861a2bde6db2

      SHA1

      8bb5b83f3cc37ff1e5ea4f02acae38e72364c114

      SHA256

      51651f27f54c7261887037aa1de4eff0a26c6807906dfc34a15cd5a0b58a8431

      SHA512

      1c4b21dd5660bfec8347257bb3da64681b0a97c427790d9ab3484f687dac032bcff0e07876635953697b00cf83e7d37f97c44e0219627fd0533f60ed3024b97e

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_fe80cd26-0cf7-4e38-9884-6dab53b04ca9
      MD5

      b6d38f250ccc9003dd70efd3b778117f

      SHA1

      d5a17c02cac698d4f0a4a9b7d71db2aa19e3f18a

      SHA256

      4de9d7b5ccab7b67ca8efc83084c7ee6e5e872b7216ed4683bc5da950bf41265

      SHA512

      67d8195836b7f280d3f9219fd0f58276342e55d5dfdd8a4c54355030d96685d73f1b2b6da0eb39322ec7c3a1d1c5ef06b52d22646cea30a96f822de1800d31e9

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
      MD5

      ede4c1a525305b3c773a911282a45a60

      SHA1

      0cf128fdb3764763ccd7a733a7ba901776d4f34b

      SHA256

      fd96ddddcd1808efde85e8fc9d2015430adf0dac289b0cd17e7a9085c1639d91

      SHA512

      c4c8ebe19fbdb6886f4fb2215f691dceaf601fe4b54c79d35869fe67582f98e3e8e6076dbdf49961c561548bfd768566e165a49dd1a63904e26b1b45ccc12dc8

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
      MD5

      06fefbbb2e8c03d2c35d21fd8ee255b9

      SHA1

      a79c24758a66fa19641b3582420ad7f051f85aff

      SHA256

      394ed4e268e9a155a9c418acbb1d80dacf31d3975bff8ef666c8d946c313d2b6

      SHA512

      7a31b803d60318bb03d7523926ba89900c719dbfeaa8e60e752b6e76211365ba8df0fee171d10c2e5075b623db3d63c0eaaede83e49c31cadcba9d49ac93c128

    • C:\Users\Admin\AppData\Local\Temp\tmpBF97.tmp
      MD5

      3ce576532e3e830f6b21265dd90d687b

      SHA1

      9c358f852f413dfc29cd2fecb5705a4248ac9cb6

      SHA256

      1ad3454c5e77349a4da13f0be266a75f6a00fa384dd7f711260ff54ba32c6863

      SHA512

      a75358e29bd8488019334e4e907ce9c8a420e0a529afc6d7bcec5e8d1e4f296c332be4dc9b9ee4dd254f8ae6f8086cd76517db5322245eb7261f60c0a9900ea8

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      MD5

      0b3a8dc769e58703850b66b6450b1a02

      SHA1

      c76059a2ab911adb28e7a33df680b4be1fe0a78f

      SHA256

      f78310c107abc42912120fa4185567a69c3072a2df0752b9085d03c05f4bf61c

      SHA512

      e96e88a464c3d68a8c3675aadfff0013e2b007012ba11c5ba55189054a8cb268d60a14d4c8b4885b278654b72b9959c36c8fca21c23773f2958c621eeab79f51

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
      MD5

      0b3a8dc769e58703850b66b6450b1a02

      SHA1

      c76059a2ab911adb28e7a33df680b4be1fe0a78f

      SHA256

      f78310c107abc42912120fa4185567a69c3072a2df0752b9085d03c05f4bf61c

      SHA512

      e96e88a464c3d68a8c3675aadfff0013e2b007012ba11c5ba55189054a8cb268d60a14d4c8b4885b278654b72b9959c36c8fca21c23773f2958c621eeab79f51

    • memory/980-70-0x00000000023C0000-0x00000000023C1000-memory.dmp
      Filesize

      4KB

    • memory/980-75-0x0000000004872000-0x0000000004873000-memory.dmp
      Filesize

      4KB

    • memory/980-72-0x00000000048B0000-0x00000000048B1000-memory.dmp
      Filesize

      4KB

    • memory/980-74-0x0000000004870000-0x0000000004871000-memory.dmp
      Filesize

      4KB

    • memory/980-65-0x0000000000000000-mapping.dmp
    • memory/980-66-0x00000000752F1000-0x00000000752F3000-memory.dmp
      Filesize

      8KB

    • memory/1072-59-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
      Filesize

      4KB

    • memory/1072-61-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
      Filesize

      4KB

    • memory/1072-62-0x00000000003D0000-0x00000000003FD000-memory.dmp
      Filesize

      180KB

    • memory/1072-63-0x00000000092D0000-0x0000000009341000-memory.dmp
      Filesize

      452KB

    • memory/1072-64-0x0000000000500000-0x000000000052C000-memory.dmp
      Filesize

      176KB

    • memory/1248-89-0x0000000002340000-0x0000000002F8A000-memory.dmp
      Filesize

      12.3MB

    • memory/1248-67-0x0000000000000000-mapping.dmp
    • memory/1248-98-0x0000000005850000-0x0000000005851000-memory.dmp
      Filesize

      4KB

    • memory/1248-103-0x0000000006220000-0x0000000006221000-memory.dmp
      Filesize

      4KB

    • memory/1248-104-0x0000000006260000-0x0000000006261000-memory.dmp
      Filesize

      4KB

    • memory/1248-105-0x000000007EF30000-0x000000007EF31000-memory.dmp
      Filesize

      4KB

    • memory/1248-112-0x00000000063C0000-0x00000000063C1000-memory.dmp
      Filesize

      4KB

    • memory/1248-135-0x0000000006450000-0x0000000006451000-memory.dmp
      Filesize

      4KB

    • memory/1248-134-0x0000000006440000-0x0000000006441000-memory.dmp
      Filesize

      4KB

    • memory/1248-119-0x0000000005710000-0x0000000005711000-memory.dmp
      Filesize

      4KB

    • memory/1556-90-0x0000000000400000-0x000000000055E000-memory.dmp
      Filesize

      1.4MB

    • memory/1556-77-0x0000000000400000-0x000000000055E000-memory.dmp
      Filesize

      1.4MB

    • memory/1556-79-0x0000000000405E28-mapping.dmp
    • memory/1716-91-0x0000000004880000-0x0000000004881000-memory.dmp
      Filesize

      4KB

    • memory/1716-86-0x0000000002690000-0x0000000002691000-memory.dmp
      Filesize

      4KB

    • memory/1716-93-0x0000000004950000-0x0000000004951000-memory.dmp
      Filesize

      4KB

    • memory/1716-76-0x0000000000000000-mapping.dmp
    • memory/1716-92-0x0000000004882000-0x0000000004883000-memory.dmp
      Filesize

      4KB

    • memory/1808-68-0x0000000000000000-mapping.dmp