Analysis
- max time kernel
127s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
23/03/2022, 15:23
Static task
static1
Behavioral task
behavioral1
Sample
Purch Ord -5264674337.exe
Resource
win7-20220311-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Purch Ord -5264674337.exe
Resource
win10v2004-20220310-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target Purch Ord -5264674337.exe
- Size 93KB
- Sample220323-sshngsgcd6
- SHA256 3e61ff7da9c135135af8936d7fb362a285b02c6431c8614eda55d2cce3bf3ff7
- MD5 b391c7822b918ca0eb73c9d25bc18398
- SHA1 63421b28a10f2824168479924f755a2c3b7fbe7c
- SHA512 f2905a11bbee8f825c5f09141a3b3be3f6e2035c06864c7c0ef475cc0486b5b4ab1353491b1d1798a546a2aa8f72d814e2e87f29465c2fc4dc4db862897aaa0e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
warzonerat
C2
-
opaqueslots.duckdns.org:67
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purch Ord -5264674337.exe Purch Ord -5264674337.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Purch Ord -5264674337.exe Purch Ord -5264674337.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4408 set thread context of 4716 4408 Purch Ord -5264674337.exe 99 - Program crash 1 IoCs
pid pid_target Process procid_target 872 4716 WerFault.exe 99 - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe 4408 Purch Ord -5264674337.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4408 Purch Ord -5264674337.exe - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 4408 wrote to memory of 4420 4408 Purch Ord -5264674337.exe 98 PID 4408 wrote to memory of 4420 4408 Purch Ord -5264674337.exe 98 PID 4408 wrote to memory of 4420 4408 Purch Ord -5264674337.exe 98 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99 PID 4408 wrote to memory of 4716 4408 Purch Ord -5264674337.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purch Ord -5264674337.exe"C:\Users\Admin\AppData\Local\Temp\Purch Ord -5264674337.exe"1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Users\Admin\AppData\Local\Temp\Purch Ord -5264674337.exe"C:\Users\Admin\AppData\Local\Temp\Purch Ord -5264674337.exe"2⤵PID:4420
-
-
C:\Users\Admin\AppData\Local\Temp\Purch Ord -5264674337.exe"C:\Users\Admin\AppData\Local\Temp\Purch Ord -5264674337.exe"2⤵PID:4716
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4716 -s 5203⤵
- Program crash
PID:872
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4716 -ip 47161⤵PID:444