Analysis
- max time kernel
99s - max time network
142s - platform
windows7_x64 - resource
win7-20220414-en - submitted
20/06/2022, 02:43
General
- Target Doc.exe
- Size 368KB
- Sample220620-c7khmaedd5
- SHA256 e1f652cc24531e85e52b8a04cdaf9d925206c0d8d306426897868bd045729cc5
Malware Config
Extracted
-
warzonerat
-
gameofthrone.ddns.net:2345
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
- suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
- Warzone RAT Payload 8 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Doc.exe"C:\Users\Admin\AppData\Local\Temp\Doc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Doc.exe"C:\Users\Admin\AppData\Local\Temp\Doc.exe"2⤵
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1644-54-0x0000000000E20000-0x0000000000E82000-memory.dmp
memory/1644-55-0x00000000769D1000-0x00000000769D3000-memory.dmp
memory/1644-56-0x00000000001F0000-0x00000000001FE000-memory.dmp
memory/1644-57-0x00000000050F0000-0x000000000514A000-memory.dmp
memory/1644-58-0x0000000000750000-0x0000000000772000-memory.dmp
memory/1784-59-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-60-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-62-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-64-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-65-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-67-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-68-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-69-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-73-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-74-0x0000000000400000-0x0000000000554000-memory.dmp
memory/1784-75-0x0000000003050000-0x0000000003150000-memory.dmp