Analysis
-
max time kernel
131s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 18:39
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT DETAILS.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
PAYMENT DETAILS.exe
Resource
win10v2004-20220414-en
General
-
Target
PAYMENT DETAILS.exe
-
Size
1.3MB
-
MD5
2232dfdb7c3927d73d832bb782821eae
-
SHA1
dba1ac5f1cf909ce1a6cb6c860d50e6e86f7ea13
-
SHA256
785c0d4d25629a52bf22014d5e21c10dbd19e6e7958eb400ea445182a827578f
-
SHA512
a3c194f33643d3a7e8b23443bae754d35a21f37d7b0bb454e41933fbdabaffee3e7ba6e1b5b2f16f353b9df7ccfd61f358f5b5099559eaf38975111abfa8666b
Malware Config
Extracted
warzonerat
52.168.163.161:5200
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/784-55-0x0000000000630000-0x0000000000783000-memory.dmp warzonerat behavioral1/memory/784-61-0x0000000000250000-0x0000000000350000-memory.dmp warzonerat behavioral1/memory/1988-70-0x0000000000450000-0x00000000005A3000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
Processes:
images.exepid process 1988 images.exe -
Drops startup file 2 IoCs
Processes:
PAYMENT DETAILS.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start PAYMENT DETAILS.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat PAYMENT DETAILS.exe -
Loads dropped DLL 1 IoCs
Processes:
PAYMENT DETAILS.exepid process 784 PAYMENT DETAILS.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
PAYMENT DETAILS.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" PAYMENT DETAILS.exe -
NTFS ADS 1 IoCs
Processes:
PAYMENT DETAILS.exedescription ioc process File created C:\ProgramData:ApplicationData PAYMENT DETAILS.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1992 powershell.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
PAYMENT DETAILS.exedescription pid process target process PID 784 wrote to memory of 1992 784 PAYMENT DETAILS.exe powershell.exe PID 784 wrote to memory of 1992 784 PAYMENT DETAILS.exe powershell.exe PID 784 wrote to memory of 1992 784 PAYMENT DETAILS.exe powershell.exe PID 784 wrote to memory of 1992 784 PAYMENT DETAILS.exe powershell.exe PID 784 wrote to memory of 1988 784 PAYMENT DETAILS.exe images.exe PID 784 wrote to memory of 1988 784 PAYMENT DETAILS.exe images.exe PID 784 wrote to memory of 1988 784 PAYMENT DETAILS.exe images.exe PID 784 wrote to memory of 1988 784 PAYMENT DETAILS.exe images.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT DETAILS.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT DETAILS.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramDataMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
C:\ProgramData\images.exeFilesize
1.3MB
MD52232dfdb7c3927d73d832bb782821eae
SHA1dba1ac5f1cf909ce1a6cb6c860d50e6e86f7ea13
SHA256785c0d4d25629a52bf22014d5e21c10dbd19e6e7958eb400ea445182a827578f
SHA512a3c194f33643d3a7e8b23443bae754d35a21f37d7b0bb454e41933fbdabaffee3e7ba6e1b5b2f16f353b9df7ccfd61f358f5b5099559eaf38975111abfa8666b
-
\ProgramData\images.exeFilesize
1.3MB
MD52232dfdb7c3927d73d832bb782821eae
SHA1dba1ac5f1cf909ce1a6cb6c860d50e6e86f7ea13
SHA256785c0d4d25629a52bf22014d5e21c10dbd19e6e7958eb400ea445182a827578f
SHA512a3c194f33643d3a7e8b23443bae754d35a21f37d7b0bb454e41933fbdabaffee3e7ba6e1b5b2f16f353b9df7ccfd61f358f5b5099559eaf38975111abfa8666b
-
memory/784-54-0x0000000076391000-0x0000000076393000-memory.dmpFilesize
8KB
-
memory/784-55-0x0000000000630000-0x0000000000783000-memory.dmpFilesize
1.3MB
-
memory/784-61-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/1988-64-0x0000000000000000-mapping.dmp
-
memory/1988-70-0x0000000000450000-0x00000000005A3000-memory.dmpFilesize
1.3MB
-
memory/1992-62-0x0000000000000000-mapping.dmp
-
memory/1992-68-0x0000000074250000-0x00000000747FB000-memory.dmpFilesize
5.7MB