Analysis
- max time kernel
91s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
01/03/2022, 18:28
General
- Target PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr
- Size 379KB
- Sample220301-w4bk4acgap
- SHA256 75a25fe05bbcefe44a5965015d178374e74b2d2be3ec2fba5d15cf37dc93df20
Malware Config
Extracted
-
warzonerat
-
185.156.175.51:64832
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 10 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr"C:\Users\Admin\AppData\Local\Temp\PO_IN00043INBOM_Specifications Sheet^^^^^dwg.scr" /S1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2396-138-0x0000000000400000-0x000000000055E000-memory.dmp
memory/2396-139-0x0000000000400000-0x000000000055E000-memory.dmp
memory/2396-140-0x0000000000400000-0x000000000055E000-memory.dmp
memory/2396-141-0x0000000004670000-0x00000000046F4000-memory.dmp
memory/2932-137-0x0000000005990000-0x00000000059F6000-memory.dmp
memory/2932-130-0x000000007531E000-0x000000007531F000-memory.dmp
memory/2932-136-0x0000000005D40000-0x0000000005DD2000-memory.dmp
memory/2932-135-0x00000000062F0000-0x0000000006894000-memory.dmp
memory/2932-134-0x0000000005C80000-0x0000000005D32000-memory.dmp
memory/2932-133-0x0000000005B70000-0x0000000005BC0000-memory.dmp
memory/2932-132-0x0000000005110000-0x0000000005111000-memory.dmp
memory/2932-131-0x0000000000470000-0x00000000004D4000-memory.dmp