Analysis
- max time kernel
105s - max time network
144s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
22/11/2021, 04:47
General
- Target 69f87da182607a06d0b07bbbc80dd0c2.exe
- Size 812KB
- Sample211122-fejmeaeghp
- SHA256 1612d570ede05d3c41efb74c5777e172e822032eeacbbefc95fb90f8ed943e6e
Malware Config
Extracted
-
warzonerat
-
20.114.22.8:7740
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 3 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\69f87da182607a06d0b07bbbc80dd0c2.exe"C:\Users\Admin\AppData\Local\Temp\69f87da182607a06d0b07bbbc80dd0c2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\upjTTOA.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\upjTTOA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp46AA.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\69f87da182607a06d0b07bbbc80dd0c2.exe"C:\Users\Admin\AppData\Local\Temp\69f87da182607a06d0b07bbbc80dd0c2.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/644-143-0x00000000077D0000-0x00000000077D1000-memory.dmp
memory/644-135-0x0000000006CF0000-0x0000000006CF1000-memory.dmp
memory/644-161-0x0000000008C20000-0x0000000008C21000-memory.dmp
memory/644-154-0x0000000008C40000-0x0000000008C73000-memory.dmp
memory/644-147-0x0000000004250000-0x0000000004251000-memory.dmp
memory/644-146-0x0000000007EC0000-0x0000000007EC1000-memory.dmp
memory/644-145-0x0000000007E70000-0x0000000007E71000-memory.dmp
memory/644-144-0x00000000075F0000-0x00000000075F1000-memory.dmp
memory/644-237-0x00000000043A3000-0x00000000043A4000-memory.dmp
memory/644-138-0x0000000006D90000-0x0000000006D91000-memory.dmp
memory/644-131-0x0000000004250000-0x0000000004251000-memory.dmp
memory/644-132-0x0000000004360000-0x0000000004361000-memory.dmp
memory/644-167-0x0000000009160000-0x0000000009161000-memory.dmp
memory/644-134-0x0000000006EA0000-0x0000000006EA1000-memory.dmp
memory/644-166-0x0000000008C90000-0x0000000008C91000-memory.dmp
memory/644-141-0x00000000043A2000-0x00000000043A3000-memory.dmp
memory/644-236-0x000000007F430000-0x000000007F431000-memory.dmp
memory/644-130-0x0000000004250000-0x0000000004251000-memory.dmp
memory/644-139-0x0000000007580000-0x0000000007581000-memory.dmp
memory/644-140-0x00000000043A0000-0x00000000043A1000-memory.dmp
memory/2668-121-0x0000000005360000-0x0000000005361000-memory.dmp
memory/2668-120-0x0000000005860000-0x0000000005861000-memory.dmp
memory/2668-118-0x00000000009D0000-0x00000000009D1000-memory.dmp
memory/2668-127-0x0000000006160000-0x00000000061A8000-memory.dmp
memory/2668-126-0x0000000006200000-0x0000000006201000-memory.dmp
memory/2668-125-0x00000000054D0000-0x00000000054D1000-memory.dmp
memory/2668-124-0x00000000054C0000-0x00000000054C4000-memory.dmp
memory/2668-123-0x00000000052B0000-0x00000000052B1000-memory.dmp
memory/2668-122-0x0000000005360000-0x000000000585E000-memory.dmp
memory/4020-142-0x0000000000400000-0x0000000000554000-memory.dmp
memory/4020-136-0x0000000000400000-0x0000000000554000-memory.dmp