Analysis
- max time kernel
153s - max time network
156s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
21/12/2021, 08:37
General
- Target c6f60cfece5d90cadddcf91a33fb5252.exe
- Size 147KB
- Sample211221-kh522adecp
- SHA256 28aa8ae80960e14db5f893829a24ca7ad2d184acd8a5626b524517279fa2cff3
Malware Config
Extracted
-
smokeloader
-
2020
-
http://rcacademy.at/upload/
-
http://e-lanpengeonline.com/upload/
-
http://vjcmvz.cn/upload/
-
http://galala.ru/upload/
-
http://witra.ru/upload/
Extracted
-
warzonerat
-
185.209.29.179:5578
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Warzone RAT Payload 3 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Deletes itself 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c6f60cfece5d90cadddcf91a33fb5252.exe"C:\Users\Admin\AppData\Local\Temp\c6f60cfece5d90cadddcf91a33fb5252.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\18AF.exeC:\Users\Admin\AppData\Local\Temp\18AF.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/372-131-0x00000000037C0000-0x0000000003914000-memory.dmp
memory/1088-122-0x0000000000610000-0x0000000000764000-memory.dmp
memory/1088-127-0x0000000002790000-0x0000000003190000-memory.dmp
memory/2404-137-0x00000000005E0000-0x00000000005E1000-memory.dmp
memory/2724-116-0x0000000000400000-0x0000000000816000-memory.dmp
memory/2724-117-0x00000000001C0000-0x00000000001C9000-memory.dmp
memory/2724-115-0x0000000000030000-0x0000000000038000-memory.dmp
memory/3060-118-0x00000000004B0000-0x00000000004C6000-memory.dmp