Analysis
- max time kernel
110s - max time network
49s - platform
windows7_x64 - resource
win7-20220414-en - submitted
12/05/2022, 07:56
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.26190.exe
- Size 456KB
- Sample220512-jsn1tsecbl
- SHA256 b11a2a39235849816172c60a0c41ebda51b034387c088f56bb6cb2484ad62049
Malware Config
Extracted
-
warzonerat
-
76.8.53.133:1198
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 8 IoCs
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 7 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\windowsupdater.exe"C:\ProgramData\windowsupdater.exe"3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
windowsupdater.exe
windowsupdater.exe
windowsupdater.exe
memory/1680-83-0x000000006EE40000-0x000000006F3EB000-memory.dmp
memory/1764-81-0x0000000000C70000-0x0000000000CE2000-memory.dmp
memory/1808-55-0x0000000075BD1000-0x0000000075BD3000-memory.dmp
memory/1808-56-0x0000000000410000-0x0000000000418000-memory.dmp
memory/1808-57-0x0000000005040000-0x00000000050B4000-memory.dmp
memory/1808-58-0x00000000008A0000-0x00000000008C2000-memory.dmp
memory/1808-54-0x0000000001070000-0x00000000010E2000-memory.dmp
memory/1976-67-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-73-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-74-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-69-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-68-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-65-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-64-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-62-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-60-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1976-59-0x0000000000400000-0x0000000000554000-memory.dmp