Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 11:41
Static task
static1
Behavioral task
behavioral1
Sample
Purchase Order Sample drawing.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Purchase Order Sample drawing.exe
Resource
win10v2004-20220414-en
General
-
Target
Purchase Order Sample drawing.exe
-
Size
317KB
-
MD5
0d1e129def7836f7f432905af5852147
-
SHA1
4fa4432ef17fe1800612686e324b66f6f22ecc88
-
SHA256
79c839a4e34b76c27eeae91d61a5d2a3a2c218e85b713751fef954579c981e00
-
SHA512
3960ea13958baa645579c1dad89a4ddaa60a84d4b5c85f54aba1e0f1d83ec26478b199c3011f38762c6efb755e279721a3f73e04657190fe428fcf923ec5ed38
Malware Config
Extracted
warzonerat
chefdnshot.ddns.net:40951
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/5048-137-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/5048-139-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral2/memory/5048-140-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Purchase Order Sample drawing.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\wzimages = "\"C:\\Users\\Admin\\AppData\\Roaming\\wzimages.exe\"" Purchase Order Sample drawing.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Purchase Order Sample drawing.exedescription pid process target process PID 2324 set thread context of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe -
Suspicious behavior: EnumeratesProcesses 38 IoCs
Processes:
Purchase Order Sample drawing.exepid process 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe 2324 Purchase Order Sample drawing.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Purchase Order Sample drawing.exedescription pid process Token: SeDebugPrivilege 2324 Purchase Order Sample drawing.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
Purchase Order Sample drawing.exedescription pid process target process PID 2324 wrote to memory of 4124 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 4124 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 4124 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 3812 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 3812 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 3812 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe PID 2324 wrote to memory of 5048 2324 Purchase Order Sample drawing.exe Purchase Order Sample drawing.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"C:\Users\Admin\AppData\Local\Temp\Purchase Order Sample drawing.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2324-130-0x0000000000E40000-0x0000000000E96000-memory.dmpFilesize
344KB
-
memory/2324-131-0x0000000005E90000-0x0000000006434000-memory.dmpFilesize
5.6MB
-
memory/2324-132-0x0000000005830000-0x00000000058C2000-memory.dmpFilesize
584KB
-
memory/2324-133-0x00000000059F0000-0x0000000005A8C000-memory.dmpFilesize
624KB
-
memory/3812-135-0x0000000000000000-mapping.dmp
-
memory/4124-134-0x0000000000000000-mapping.dmp
-
memory/5048-136-0x0000000000000000-mapping.dmp
-
memory/5048-137-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/5048-139-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/5048-140-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB