Analysis
- max time kernel
150s - max time network
147s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
15/11/2021, 00:14
General
- Target 64b5cba596b23ad630a2e3e0d341642e.exe
- Size 32KB
- Sample211115-ajcf1aeaal
- SHA256 42d46ba1d5ccb8decfc1f10303c061ee7e1c9844d857de99a3ee862edd13dc28
Malware Config
Extracted
-
warzonerat
-
ls.pickzznoz.bar:6387
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Drops startup file 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\64b5cba596b23ad630a2e3e0d341642e.exe"C:\Users\Admin\AppData\Local\Temp\64b5cba596b23ad630a2e3e0d341642e.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\64b5cba596b23ad630a2e3e0d341642e.exeC:\Users\Admin\AppData\Local\Temp\64b5cba596b23ad630a2e3e0d341642e.exe3⤵
- Drops startup file
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
-
-
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/644-153-0x0000000008930000-0x0000000008963000-memory.dmp
memory/644-139-0x0000000007520000-0x0000000007521000-memory.dmp
memory/644-170-0x0000000001023000-0x0000000001024000-memory.dmp
memory/644-169-0x000000007F230000-0x000000007F231000-memory.dmp
memory/644-166-0x0000000008E50000-0x0000000008E51000-memory.dmp
memory/644-165-0x0000000008AC0000-0x0000000008AC1000-memory.dmp
memory/644-160-0x0000000008910000-0x0000000008911000-memory.dmp
memory/644-146-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/644-145-0x0000000007B50000-0x0000000007B51000-memory.dmp
memory/644-140-0x0000000006C70000-0x0000000006C71000-memory.dmp
memory/644-144-0x0000000001022000-0x0000000001023000-memory.dmp
memory/644-142-0x0000000001020000-0x0000000001021000-memory.dmp
memory/644-132-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/644-133-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/644-134-0x0000000000F70000-0x0000000000F71000-memory.dmp
memory/644-135-0x0000000006DF0000-0x0000000006DF1000-memory.dmp
memory/644-136-0x0000000006A00000-0x0000000006A01000-memory.dmp
memory/644-141-0x0000000007C00000-0x0000000007C01000-memory.dmp
memory/644-137-0x0000000006BA0000-0x0000000006BA1000-memory.dmp
memory/860-143-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/2036-356-0x0000000002C40000-0x0000000002D40000-memory.dmp
memory/2036-390-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/2036-388-0x0000000000E30000-0x0000000000E31000-memory.dmp
memory/2036-130-0x0000000002C40000-0x0000000002D40000-memory.dmp
memory/2036-389-0x00007FFC45C60000-0x00007FFC45C66000-memory.dmp
memory/2036-387-0x00007FFC45C40000-0x00007FFC45C50000-memory.dmp
memory/3200-126-0x0000000000400000-0x000000000055E000-memory.dmp
memory/3200-128-0x0000000000400000-0x000000000055E000-memory.dmp
memory/3952-124-0x00000000057D0000-0x00000000057D1000-memory.dmp
memory/3952-121-0x0000000005550000-0x00000000055A9000-memory.dmp
memory/3952-122-0x0000000005AB0000-0x0000000005AB1000-memory.dmp
memory/3952-123-0x0000000005690000-0x0000000005691000-memory.dmp
memory/3952-118-0x0000000000020000-0x0000000000021000-memory.dmp
memory/3952-125-0x0000000000850000-0x000000000086F000-memory.dmp
memory/3952-120-0x0000000004850000-0x0000000004851000-memory.dmp