Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
12-10-2021 17:55
Static task
static1
Behavioral task
behavioral1
Sample
PCS TENDER PROFILE-20210920.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
PCS TENDER PROFILE-20210920.exe
Resource
win10v20210408
General
-
Target
PCS TENDER PROFILE-20210920.exe
-
Size
24KB
-
MD5
8475c4b32e4c24086dcef73a6c05fe3e
-
SHA1
b36a3579be00a9b414ff8e34dd6e1d944214c0c3
-
SHA256
a44ab6dc43269d5f7f13aefc084b0a4d463126eea8a3de38979b5f5f96ea6a8d
-
SHA512
d3d0e1ef48432ca5351ea919e7fe99388ed941e128c82b937d6eb94bd91c00fca6784e7df99498de68ae0ce8352dfa266d316c4bbfa716abef31a69a4922646b
Malware Config
Extracted
warzonerat
enginekeysmoney.ddns.net:9671
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\winrar-x64-561.exe\"," PCS TENDER PROFILE-20210920.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2004-119-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/2004-120-0x0000000000405CE2-mapping.dmp warzonerat behavioral2/memory/2004-121-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription pid process target process PID 992 set thread context of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
PCS TENDER PROFILE-20210920.exepid process 992 PCS TENDER PROFILE-20210920.exe 992 PCS TENDER PROFILE-20210920.exe 992 PCS TENDER PROFILE-20210920.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription pid process Token: SeDebugPrivilege 992 PCS TENDER PROFILE-20210920.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
PCS TENDER PROFILE-20210920.exedescription pid process target process PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe PID 992 wrote to memory of 2004 992 PCS TENDER PROFILE-20210920.exe PCS TENDER PROFILE-20210920.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"C:\Users\Admin\AppData\Local\Temp\PCS TENDER PROFILE-20210920.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/992-114-0x0000000000090000-0x0000000000091000-memory.dmpFilesize
4KB
-
memory/992-116-0x0000000004BD0000-0x0000000004BD1000-memory.dmpFilesize
4KB
-
memory/992-117-0x00000000057C0000-0x00000000058EE000-memory.dmpFilesize
1.2MB
-
memory/992-118-0x00000000001C0000-0x00000000001DB000-memory.dmpFilesize
108KB
-
memory/2004-119-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/2004-120-0x0000000000405CE2-mapping.dmp
-
memory/2004-121-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB