Analysis
- max time kernel
178s - max time network
181s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
12/05/2022, 07:56
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.26190.exe
- Size 456KB
- Sample220512-jsn1tsecbl
- SHA256 b11a2a39235849816172c60a0c41ebda51b034387c088f56bb6cb2484ad62049
Malware Config
Extracted
-
warzonerat
-
76.8.53.133:1198
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT Payload 5 IoCs
- Executes dropped EXE 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 31 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.26190.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\windowsupdater.exe"C:\ProgramData\windowsupdater.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\windowsupdater.exe"C:\ProgramData\windowsupdater.exe"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
windowsupdater.exe
windowsupdater.exe
windowsupdater.exe
memory/1408-137-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1408-140-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1408-139-0x0000000000400000-0x0000000000554000-memory.dmp
memory/3324-158-0x0000000000400000-0x0000000000554000-memory.dmp
memory/3324-156-0x0000000000400000-0x0000000000554000-memory.dmp
memory/3712-130-0x0000000000690000-0x0000000000702000-memory.dmp
memory/3712-135-0x0000000007A40000-0x0000000007AA6000-memory.dmp
memory/3712-133-0x00000000051C0000-0x000000000525C000-memory.dmp
memory/3712-132-0x0000000005120000-0x00000000051B2000-memory.dmp
memory/3712-134-0x00000000050B0000-0x00000000050BA000-memory.dmp
memory/3712-131-0x0000000005630000-0x0000000005BD4000-memory.dmp
memory/4028-145-0x0000000004F00000-0x0000000004F36000-memory.dmp
memory/4028-149-0x0000000006450000-0x000000000646E000-memory.dmp
memory/4028-150-0x00000000069E0000-0x0000000006A12000-memory.dmp
memory/4028-148-0x0000000005DE0000-0x0000000005E46000-memory.dmp
memory/4028-147-0x0000000005D40000-0x0000000005D62000-memory.dmp
memory/4028-146-0x00000000056E0000-0x0000000005D08000-memory.dmp
memory/4028-155-0x0000000070BE0000-0x0000000070C2C000-memory.dmp
memory/4028-157-0x0000000007690000-0x00000000076AE000-memory.dmp