Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 18:38
Static task
static1
Behavioral task
behavioral1
Sample
New Order.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
New Order.exe
Resource
win10v2004-20220414-en
General
-
Target
New Order.exe
-
Size
1.3MB
-
MD5
fb5b35716632d1ec30f13ea6c1c8ac69
-
SHA1
c4a066ecb0e73b431561eb5f209af51e361f0467
-
SHA256
a33a4dcab1d0b4c87dc0041862aef871d365273a0baa94162ef4ff85af51c578
-
SHA512
c1028ab4f4830c1166ba393ac1fff986e6c6cb9ada84af54c707998342005297e3abb16129368c2420cecebd4877d11edc9dca1ed118eabe349521e58139245b
Malware Config
Extracted
warzonerat
79.134.225.40:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2052-130-0x0000000000BB0000-0x0000000000D03000-memory.dmp warzonerat behavioral2/memory/2052-132-0x0000000000AB0000-0x0000000000BB0000-memory.dmp warzonerat behavioral2/memory/4484-157-0x0000000001030000-0x0000000001183000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
Processes:
images.exepid process 4484 images.exe -
Drops startup file 2 IoCs
Processes:
New Order.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start New Order.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat New Order.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
New Order.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" New Order.exe -
NTFS ADS 1 IoCs
Processes:
New Order.exedescription ioc process File created C:\ProgramData:ApplicationData New Order.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 828 powershell.exe 828 powershell.exe 3976 powershell.exe 3976 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 828 powershell.exe Token: SeDebugPrivilege 3976 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
New Order.exeimages.exedescription pid process target process PID 2052 wrote to memory of 828 2052 New Order.exe powershell.exe PID 2052 wrote to memory of 828 2052 New Order.exe powershell.exe PID 2052 wrote to memory of 828 2052 New Order.exe powershell.exe PID 2052 wrote to memory of 4484 2052 New Order.exe images.exe PID 2052 wrote to memory of 4484 2052 New Order.exe images.exe PID 2052 wrote to memory of 4484 2052 New Order.exe images.exe PID 4484 wrote to memory of 3976 4484 images.exe powershell.exe PID 4484 wrote to memory of 3976 4484 images.exe powershell.exe PID 4484 wrote to memory of 3976 4484 images.exe powershell.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"1⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
1.3MB
MD5fb5b35716632d1ec30f13ea6c1c8ac69
SHA1c4a066ecb0e73b431561eb5f209af51e361f0467
SHA256a33a4dcab1d0b4c87dc0041862aef871d365273a0baa94162ef4ff85af51c578
SHA512c1028ab4f4830c1166ba393ac1fff986e6c6cb9ada84af54c707998342005297e3abb16129368c2420cecebd4877d11edc9dca1ed118eabe349521e58139245b
-
C:\ProgramData\images.exeFilesize
1.3MB
MD5fb5b35716632d1ec30f13ea6c1c8ac69
SHA1c4a066ecb0e73b431561eb5f209af51e361f0467
SHA256a33a4dcab1d0b4c87dc0041862aef871d365273a0baa94162ef4ff85af51c578
SHA512c1028ab4f4830c1166ba393ac1fff986e6c6cb9ada84af54c707998342005297e3abb16129368c2420cecebd4877d11edc9dca1ed118eabe349521e58139245b
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD5b0a5824f88e32f364473ce6987c15d59
SHA100b2951c5c593e61ce112f08acd15acb6c2f97e0
SHA256f448c6a7498d2559174f3cb71d0291e70380276fd7421fd7b4bf03f76736fe34
SHA512f8f58d2275dfbfe8cc06ba35a0e777906422f6afbe20cf10dbc62c5cbc0fcdd35ab6a81eba11d7e750a813d567f91c773e94dd48068f6b115e4e14af5f4d1157
-
memory/828-149-0x0000000006780000-0x000000000679E000-memory.dmpFilesize
120KB
-
memory/828-152-0x0000000007540000-0x000000000754A000-memory.dmpFilesize
40KB
-
memory/828-141-0x00000000028A0000-0x00000000028D6000-memory.dmpFilesize
216KB
-
memory/828-142-0x00000000053E0000-0x0000000005A08000-memory.dmpFilesize
6.2MB
-
memory/828-143-0x0000000005320000-0x0000000005342000-memory.dmpFilesize
136KB
-
memory/828-144-0x0000000005B00000-0x0000000005B66000-memory.dmpFilesize
408KB
-
memory/828-145-0x0000000005BE0000-0x0000000005C46000-memory.dmpFilesize
408KB
-
memory/828-146-0x00000000061D0000-0x00000000061EE000-memory.dmpFilesize
120KB
-
memory/828-147-0x00000000067A0000-0x00000000067D2000-memory.dmpFilesize
200KB
-
memory/828-148-0x00000000707A0000-0x00000000707EC000-memory.dmpFilesize
304KB
-
memory/828-137-0x0000000000000000-mapping.dmp
-
memory/828-150-0x0000000007B20000-0x000000000819A000-memory.dmpFilesize
6.5MB
-
memory/828-151-0x00000000074D0000-0x00000000074EA000-memory.dmpFilesize
104KB
-
memory/828-156-0x00000000077F0000-0x00000000077F8000-memory.dmpFilesize
32KB
-
memory/828-153-0x0000000007750000-0x00000000077E6000-memory.dmpFilesize
600KB
-
memory/828-154-0x0000000007700000-0x000000000770E000-memory.dmpFilesize
56KB
-
memory/828-155-0x0000000007810000-0x000000000782A000-memory.dmpFilesize
104KB
-
memory/2052-130-0x0000000000BB0000-0x0000000000D03000-memory.dmpFilesize
1.3MB
-
memory/2052-132-0x0000000000AB0000-0x0000000000BB0000-memory.dmpFilesize
1024KB
-
memory/3976-163-0x0000000000000000-mapping.dmp
-
memory/3976-167-0x0000000070620000-0x000000007066C000-memory.dmpFilesize
304KB
-
memory/4308-166-0x0000000000000000-mapping.dmp
-
memory/4308-168-0x00000000009F0000-0x00000000009F1000-memory.dmpFilesize
4KB
-
memory/4484-138-0x0000000000000000-mapping.dmp
-
memory/4484-157-0x0000000001030000-0x0000000001183000-memory.dmpFilesize
1.3MB