Overview

overview

10

Static

static

SOA & UNPA...df.exe

windows7_x64

10

SOA & UNPA...df.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    21-05-2022 06:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SOA & UNPAID INVOICES.pdf.exe

  • Size

    670KB

  • MD5

    b6e3ea3ca41fadf4b2d8e8c4547bbb3b

  • SHA1

    dbd634b213e1dba07b9d3cb4b880d2db158818f7

  • SHA256

    a9e823696e9c25dda75eae39878e430238e78b379bb51a0658d8fd93bd2c604d

  • SHA512

    ecc6d1b83eada0530986c3357a56b51253686bc3db150601daf8cca0dce4db0349a4ec75bb702c808aee2c5618bdb120d8ba249b20fa9426d6983f7d4516fa29

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

76.8.53.133:1198

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzone RAT Payload 8 IoCs
    rat
  • Sets DLL path for service in the registry 2 TTPs
    persistence
  • Loads dropped DLL 1 IoCs
  • Modifies WinLogon 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: LoadsDriver 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:872
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TsWISurTqG.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1236
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TsWISurTqG" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEC24.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2040
    • C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe
      "C:\Users\Admin\AppData\Local\Temp\SOA & UNPAID INVOICES.pdf.exe"
      2⤵
      • Modifies WinLogon
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1820
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell Add-MpPreference -ExclusionPath C:\
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpEC24.tmp
    Filesize

    1KB

    MD5

    c7494b0d5ba2cfe232a21d899cfe7c49

    SHA1

    3f4e20c5bac95205131bba001269115abb0a28c3

    SHA256

    d6e09cfede40b0ac815b131a0a65373af786d73a6a544ab3fbe417c71f6d19c9

    SHA512

    11c6975d502bdc58d83cf667e13aa4adaee2bccc949ba5f9544b7c91b689abbb26eef04595de969e41dea8fb03e6160d58de7fe8265ddeab6870bbf2681d50de

    Download Submit
  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
    Filesize

    7KB

    MD5

    9140ec27d61f938e816f0c9696338ed8

    SHA1

    46be10ea06def02b03fa55ea0a8ae1d12425f311

    SHA256

    968aea60bacaaa24261e3948329f449eb80fcade603cae1a679befb4b76872cc

    SHA512

    a6b1f66e5dbb92d654ed95438eace818803bdcd0787a54df414b554e9a76e856414291e21ca53c1c2122d4e5ec25c837d0e8cb1e85e1cc30ed3bd1a1f2d838ab

    Download Submit
  • \Program Files\Microsoft DN1\sqlmap.dll
    Filesize

    114KB

    MD5

    461ade40b800ae80a40985594e1ac236

    SHA1

    b3892eef846c044a2b0785d54a432b3e93a968c8

    SHA256

    798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4

    SHA512

    421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26

    Download Submit
  • memory/872-54-0x0000000000320000-0x00000000003CE000-memory.dmp
    Filesize

    696KB

    Download
  • memory/872-55-0x00000000764C1000-0x00000000764C3000-memory.dmp
    Filesize

    8KB

    Download
  • memory/872-56-0x0000000000310000-0x000000000031A000-memory.dmp
    Filesize

    40KB

    Download
  • memory/872-57-0x0000000005EE0000-0x0000000005F64000-memory.dmp
    Filesize

    528KB

    Download
  • memory/872-62-0x0000000004BB0000-0x0000000004BD8000-memory.dmp
    Filesize

    160KB

    Download
  • memory/1236-78-0x000000006E9D0000-0x000000006EF7B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1236-58-0x0000000000000000-mapping.dmp
    Download
  • memory/1820-77-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-63-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-69-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-71-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-72-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-73-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-68-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-64-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-74-0x0000000000405CE2-mapping.dmp
    Download
  • memory/1820-79-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-66-0x0000000000400000-0x0000000000554000-memory.dmp
    Filesize

    1.3MB

    Download
  • memory/1820-84-0x00000000030C0000-0x00000000031C0000-memory.dmp
    Filesize

    1024KB

    Download
  • memory/1944-83-0x0000000073DB0000-0x000000007435B000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/1944-80-0x0000000000000000-mapping.dmp
    Download
  • memory/2040-59-0x0000000000000000-mapping.dmp
    Download