Analysis
- max time kernel
4294183s - max time network
138s - platform
windows7_x64 - resource
win7-20220223-en - submitted
01/03/2022, 18:28
General
- Target PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr
- Size 379KB
- Sample220301-w4bk4acgap
- SHA256 75a25fe05bbcefe44a5965015d178374e74b2d2be3ec2fba5d15cf37dc93df20
Malware Config
Extracted
-
warzonerat
-
185.156.175.51:64832
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr"C:\Users\Admin\AppData\Local\Temp\PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr" /S1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-70-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-71-0x0000000003BA0000-0x0000000003C24000-memory.dmp
memory/396-62-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-63-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-64-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-65-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-66-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-67-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-69-0x0000000000400000-0x000000000055E000-memory.dmp
memory/396-61-0x0000000000400000-0x000000000055E000-memory.dmp
memory/816-54-0x0000000000910000-0x0000000000974000-memory.dmp
memory/816-60-0x0000000004980000-0x00000000049CC000-memory.dmp
memory/816-59-0x0000000001FB0000-0x0000000001FEE000-memory.dmp
memory/816-58-0x0000000001F60000-0x0000000001FB6000-memory.dmp
memory/816-56-0x000000007437E000-0x000000007437F000-memory.dmp
memory/816-57-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/816-55-0x0000000074FF1000-0x0000000074FF3000-memory.dmp