Analysis
- max time kernel
149s - max time network
153s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
12/01/2022, 11:06
General
- Target 32ac830fd8d20efe0f7316bc724d67ca.exe
- Size 1.0MB
- Sample220112-m7ebqacdgr
- SHA256 c6fcfa2b71a7e372ec17ad65278786c011a32cd9008e3879bdd59ad1addf63bb
Malware Config
Extracted
-
warzonerat
-
nyambe.duckdns.org:5200
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Nirsoft 5 IoCs
- Warzone RAT Payload 2 IoCs
- Executes dropped EXE 4 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 36 IoCs
- Suspicious use of AdjustPrivilegeToken 15 IoCs
- Suspicious use of WriteProcessMemory 52 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\32ac830fd8d20efe0f7316bc724d67ca.exe"C:\Users\Admin\AppData\Local\Temp\32ac830fd8d20efe0f7316bc724d67ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc aQBwAGMAbwBuAGYAaQBnACAALwByAGUAbABlAGEAcwBlAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /release3⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc aQBwAGMAbwBuAGYAaQBnACAALwByAGUAbgBlAHcA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\system32\ipconfig.exe" /renew3⤵
- Gathers network information
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAuADUA2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\sc.exe" /WindowState 0 /CommandLine "stop WinDefend" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 35163⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /EXEFilename "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /WindowState 0 /CommandLine "rmdir 'C:\ProgramData\Microsoft\Windows Defender' -Recurse" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\AdvancedRun.exe" /SpecialRun 4101d8 29923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Start-Sleep -s 5; Remove-Item -Path "C:\Users\Admin\AppData\Local\Temp\32ac830fd8d20efe0f7316bc724d67ca.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\32ac830fd8d20efe0f7316bc724d67ca.exeC:\Users\Admin\AppData\Local\Temp\32ac830fd8d20efe0f7316bc724d67ca.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/356-227-0x0000000000400000-0x0000000000554000-memory.dmp
memory/672-251-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/672-250-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/672-261-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/1140-225-0x0000000004DC0000-0x0000000004DF6000-memory.dmp
memory/1140-231-0x00000000080B0000-0x0000000008116000-memory.dmp
memory/1140-240-0x0000000003390000-0x0000000003391000-memory.dmp
memory/1140-223-0x0000000003390000-0x0000000003391000-memory.dmp
memory/1140-224-0x0000000003390000-0x0000000003391000-memory.dmp
memory/1140-226-0x0000000007980000-0x0000000007FA8000-memory.dmp
memory/1140-229-0x0000000007800000-0x0000000007822000-memory.dmp
memory/1140-230-0x0000000008190000-0x00000000081F6000-memory.dmp
memory/2468-210-0x0000000005880000-0x00000000058DC000-memory.dmp
memory/2468-221-0x0000000005F10000-0x0000000005FA2000-memory.dmp
memory/2468-117-0x00000000059C0000-0x00000000059C1000-memory.dmp
memory/2468-115-0x0000000000F60000-0x0000000001068000-memory.dmp
memory/2468-116-0x0000000000F60000-0x0000000001068000-memory.dmp
memory/3552-177-0x0000000007D80000-0x0000000007DCB000-memory.dmp
memory/3552-182-0x0000000000F00000-0x0000000000F01000-memory.dmp
memory/3552-185-0x0000000004A14000-0x0000000004A16000-memory.dmp
memory/3552-184-0x0000000004A13000-0x0000000004A14000-memory.dmp
memory/3552-179-0x0000000000F00000-0x0000000000F01000-memory.dmp
memory/3552-178-0x0000000008080000-0x00000000080F6000-memory.dmp
memory/3552-175-0x0000000004A10000-0x0000000004A11000-memory.dmp
memory/3552-165-0x0000000000F00000-0x0000000000F01000-memory.dmp
memory/3552-164-0x0000000000F00000-0x0000000000F01000-memory.dmp
memory/3552-166-0x0000000001020000-0x0000000001056000-memory.dmp
memory/3552-167-0x00000000070B0000-0x00000000076D8000-memory.dmp
memory/3552-168-0x0000000006F00000-0x0000000006F22000-memory.dmp
memory/3552-169-0x00000000078C0000-0x0000000007926000-memory.dmp
memory/3552-170-0x0000000007930000-0x0000000007996000-memory.dmp
memory/3552-171-0x00000000079A0000-0x0000000007CF0000-memory.dmp
memory/3552-176-0x0000000004A12000-0x0000000004A13000-memory.dmp
memory/3552-174-0x0000000007D10000-0x0000000007D2C000-memory.dmp
memory/3856-123-0x0000000004A30000-0x0000000004A31000-memory.dmp
memory/3856-124-0x0000000004A32000-0x0000000004A33000-memory.dmp
memory/3856-122-0x00000000070B0000-0x00000000076D8000-memory.dmp
memory/3856-125-0x0000000006F80000-0x0000000006FA2000-memory.dmp
memory/3856-121-0x0000000001090000-0x00000000010C6000-memory.dmp
memory/3856-120-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
memory/3856-126-0x0000000007040000-0x00000000070A6000-memory.dmp
memory/3856-143-0x0000000004A34000-0x0000000004A36000-memory.dmp
memory/3856-127-0x00000000077B0000-0x0000000007816000-memory.dmp
memory/3856-119-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
memory/3856-128-0x0000000007920000-0x0000000007C70000-memory.dmp
memory/3856-129-0x0000000007780000-0x000000000779C000-memory.dmp
memory/3856-130-0x0000000007D30000-0x0000000007D7B000-memory.dmp
memory/3856-131-0x0000000008050000-0x00000000080C6000-memory.dmp
memory/3856-132-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
memory/3856-135-0x0000000000EF0000-0x0000000000EF1000-memory.dmp
memory/3856-142-0x0000000004A33000-0x0000000004A34000-memory.dmp
memory/3920-140-0x0000000000DD0000-0x0000000000E06000-memory.dmp
memory/3920-153-0x0000000007DB0000-0x0000000007E26000-memory.dmp
memory/3920-154-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/3920-160-0x0000000009500000-0x0000000009B78000-memory.dmp
memory/3920-161-0x00000000080A0000-0x00000000080BA000-memory.dmp
memory/3920-162-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/3920-151-0x0000000007A80000-0x0000000007A9C000-memory.dmp
memory/3920-146-0x0000000006C70000-0x0000000006C92000-memory.dmp
memory/3920-173-0x0000000000DC3000-0x0000000000DC4000-memory.dmp
memory/3920-149-0x00000000076D0000-0x0000000007A20000-memory.dmp
memory/3920-148-0x0000000006E10000-0x0000000006E76000-memory.dmp
memory/3920-145-0x0000000000DC2000-0x0000000000DC3000-memory.dmp
memory/3920-147-0x0000000006D40000-0x0000000006DA6000-memory.dmp
memory/3920-144-0x0000000000DC0000-0x0000000000DC1000-memory.dmp
memory/3920-152-0x0000000008000000-0x000000000804B000-memory.dmp
memory/3920-138-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/3920-141-0x0000000006EC0000-0x00000000074E8000-memory.dmp
memory/3920-139-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/3980-200-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/3980-195-0x0000000008110000-0x000000000812C000-memory.dmp
memory/3980-192-0x0000000007B70000-0x0000000007BD6000-memory.dmp
memory/3980-193-0x0000000007C50000-0x0000000007FA0000-memory.dmp
memory/3980-191-0x0000000007B00000-0x0000000007B66000-memory.dmp
memory/3980-196-0x0000000008700000-0x000000000874B000-memory.dmp
memory/3980-190-0x0000000007300000-0x0000000007322000-memory.dmp
memory/3980-189-0x0000000007360000-0x0000000007988000-memory.dmp
memory/3980-188-0x0000000004BC0000-0x0000000004BF6000-memory.dmp
memory/3980-186-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/3980-187-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/3980-211-0x0000000006D23000-0x0000000006D24000-memory.dmp
memory/3980-209-0x00000000010B0000-0x00000000010B1000-memory.dmp
memory/3980-208-0x0000000009180000-0x000000000919A000-memory.dmp
memory/3980-207-0x0000000009C40000-0x000000000A2B8000-memory.dmp
memory/3980-197-0x0000000008530000-0x00000000085A6000-memory.dmp
memory/3980-199-0x0000000006D22000-0x0000000006D23000-memory.dmp
memory/3980-198-0x0000000006D20000-0x0000000006D21000-memory.dmp
memory/4052-264-0x0000000000030000-0x0000000000031000-memory.dmp