Analysis
- max time kernel
119s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
21/01/2022, 03:03
Static task
static1
Behavioral task
behavioral1
Sample
Thanh Phat International - Products list & specifications.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Thanh Phat International - Products list & specifications.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target Thanh Phat International - Products list & specifications.exe
- Size 566KB
- Sample220121-dj2mnsdafp
- SHA256 2e38dbab77effab3cbfb5ab6df78a76e157aa1f5906157fd1bb73252c30251b6
- MD5 40c3dde32335244e5664f13bfe4a9f92
- SHA1 ff9ba2a3546abc8e338d6836d1382c9960cc6a64
- SHA512 0b684e446b8d9f86d42e6c697016c234b6d9bbf26650ac491c7314d7ee1f9d43ff493a493ad6e8be4435f51d1d4b04b624b6c15e2fc80e8fad651a6b6645f3dd
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
warzonerat
C2
-
62.197.136.188:4178
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 2 IoCs
resource yara_rule behavioral2/memory/3516-131-0x0000000000470000-0x00000000005C4000-memory.dmp warzonerat behavioral2/memory/3516-136-0x0000000000470000-0x00000000005C4000-memory.dmp warzonerat - Sets service image path in registry 2 TTPs
- Loads dropped DLL 7 IoCs
pid Process 3644 Thanh Phat International - Products list & specifications.exe 3516 Thanh Phat International - Products list & specifications.exe 3516 Thanh Phat International - Products list & specifications.exe 3516 Thanh Phat International - Products list & specifications.exe 3516 Thanh Phat International - Products list & specifications.exe 3516 Thanh Phat International - Products list & specifications.exe 3516 Thanh Phat International - Products list & specifications.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thanh Phat International - Products list & specifications.exe Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thanh Phat International - Products list & specifications.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\eynnw = "C:\\Users\\Admin\\AppData\\Roaming\\tsltacvdxuer\\faigqg.exe" Thanh Phat International - Products list & specifications.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3516 Thanh Phat International - Products list & specifications.exe - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 PID 3644 wrote to memory of 3516 3644 Thanh Phat International - Products list & specifications.exe 52 - outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thanh Phat International - Products list & specifications.exe - outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 Thanh Phat International - Products list & specifications.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Thanh Phat International - Products list & specifications.exe"C:\Users\Admin\AppData\Local\Temp\Thanh Phat International - Products list & specifications.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3644 -
C:\Users\Admin\AppData\Local\Temp\Thanh Phat International - Products list & specifications.exe"C:\Users\Admin\AppData\Local\Temp\Thanh Phat International - Products list & specifications.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3516
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 1d7a53a1e4a193b05de2de9aeec753b4 YgVdqpoXwUiqHaJ9UTdVaQ.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:3324
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵PID:3696