Analysis
-
max time kernel
139s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
12-10-2021 15:40
Static task
static1
Behavioral task
behavioral1
Sample
PCS TENDER PROFILE-20210920.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
PCS TENDER PROFILE-20210920.exe
Resource
win10-en-20210920
General
-
Target
PCS TENDER PROFILE-20210920.exe
-
Size
24KB
-
MD5
8475c4b32e4c24086dcef73a6c05fe3e
-
SHA1
b36a3579be00a9b414ff8e34dd6e1d944214c0c3
-
SHA256
a44ab6dc43269d5f7f13aefc084b0a4d463126eea8a3de38979b5f5f96ea6a8d
-
SHA512
d3d0e1ef48432ca5351ea919e7fe99388ed941e128c82b937d6eb94bd91c00fca6784e7df99498de68ae0ce8352dfa266d316c4bbfa716abef31a69a4922646b
Malware Config
Extracted
warzonerat
enginekeysmoney.ddns.net:9671
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\winrar-x64-561.exe\"," PCS TENDER PROFILE-20210920.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2712-120-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/2712-121-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/2712-122-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription pid process target process PID 1892 set thread context of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PCS TENDER PROFILE-20210920.exepid process 1892 PCS TENDER PROFILE-20210920.exe 1892 PCS TENDER PROFILE-20210920.exe 1892 PCS TENDER PROFILE-20210920.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription pid process Token: SeDebugPrivilege 1892 PCS TENDER PROFILE-20210920.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription pid process target process PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 1892 wrote to memory of 2712 1892 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1892-115-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/1892-117-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/1892-118-0x0000000006210000-0x000000000633E000-memory.dmpFilesize
1.2MB
-
memory/1892-119-0x00000000065C0000-0x00000000065DB000-memory.dmpFilesize
108KB
-
memory/2712-120-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2712-121-0x0000000000405CE2-mapping.dmp
-
memory/2712-122-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB