Analysis
- max time kernel
133s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
22/02/2022, 17:56
General
- Target winlogon.exe
- Size 990KB
- Sample220222-wh2kdsdadr
- SHA256 d066ed9d71d95f1c0d212327af37be6cdd376e116fd3ca1a204a6c23d0dadf60
Malware Config
Extracted
-
warzonerat
-
180.214.238.216:5200
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 2 IoCs
- Loads dropped DLL 6 IoCs
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\winlogon.exe"C:\Users\Admin\AppData\Local\Temp\winlogon.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3308-134-0x0000000007290000-0x000000000729A000-memory.dmp
memory/3308-136-0x00000000075A0000-0x000000000763C000-memory.dmp
memory/3308-135-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
memory/3308-130-0x0000000000330000-0x000000000042E000-memory.dmp
memory/3308-133-0x0000000007330000-0x00000000073C2000-memory.dmp
memory/3308-132-0x0000000074DBE000-0x0000000074DBF000-memory.dmp
memory/3308-131-0x0000000007840000-0x0000000007DE4000-memory.dmp
memory/4952-137-0x0000000000400000-0x0000000000554000-memory.dmp
memory/4952-138-0x0000000000400000-0x0000000000554000-memory.dmp
memory/4952-139-0x0000000003D00000-0x0000000003D84000-memory.dmp