Analysis
-
max time kernel
147s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Info.pdf.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipping Info.pdf.js
Resource
win10v2004-20220414-en
General
-
Target
Shipping Info.pdf.js
-
Size
374KB
-
MD5
1eb22e2b164c30a555d09c7537d74729
-
SHA1
db0e1a2b9604a2f70695b5749efcabd6ad0d517c
-
SHA256
e098dcf14cad6499677cbce1619ebf5ce683f45280ec95f20523319977dc8e61
-
SHA512
65b1062d62dba8b1e2707b14fd74ef2e46f7cdb494e28bb457167815b098ffd0ba6c13b2e353bf09173490e8ae0af5fc907db46b5b25c139b279d3f6d42bd172
Malware Config
Extracted
warzonerat
udooiuyt.dynamic-dns.net:5200
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
-
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral1/memory/1448-64-0x0000000000EB0000-0x0000000000EC2000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat behavioral1/memory/1816-75-0x0000000001030000-0x0000000001042000-memory.dmp asyncrat -
Warzone RAT Payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat \ProgramData\images.exe warzonerat \ProgramData\images.exe warzonerat C:\ProgramData\images.exe warzonerat C:\ProgramData\images.exe warzonerat -
Executes dropped EXE 4 IoCs
Processes:
Exemama.exeAsyncClient.exewin.exeimages.exepid process 1768 Exemama.exe 1448 AsyncClient.exe 1816 win.exe 576 images.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeExemama.exepid process 1308 cmd.exe 1768 Exemama.exe 1768 Exemama.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Exemama.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" Exemama.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 812 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
AsyncClient.exepowershell.exepowershell.exepid process 1448 AsyncClient.exe 1480 powershell.exe 1584 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AsyncClient.exewin.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1448 AsyncClient.exe Token: SeDebugPrivilege 1816 win.exe Token: SeDebugPrivilege 1480 powershell.exe Token: SeDebugPrivilege 1584 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
images.exepid process 576 images.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
wscript.exewscript.exeAsyncClient.execmd.execmd.exeExemama.exeimages.exedescription pid process target process PID 1972 wrote to memory of 1092 1972 wscript.exe wscript.exe PID 1972 wrote to memory of 1092 1972 wscript.exe wscript.exe PID 1972 wrote to memory of 1092 1972 wscript.exe wscript.exe PID 1972 wrote to memory of 1768 1972 wscript.exe Exemama.exe PID 1972 wrote to memory of 1768 1972 wscript.exe Exemama.exe PID 1972 wrote to memory of 1768 1972 wscript.exe Exemama.exe PID 1972 wrote to memory of 1768 1972 wscript.exe Exemama.exe PID 1092 wrote to memory of 1448 1092 wscript.exe AsyncClient.exe PID 1092 wrote to memory of 1448 1092 wscript.exe AsyncClient.exe PID 1092 wrote to memory of 1448 1092 wscript.exe AsyncClient.exe PID 1092 wrote to memory of 1448 1092 wscript.exe AsyncClient.exe PID 1448 wrote to memory of 1676 1448 AsyncClient.exe cmd.exe PID 1448 wrote to memory of 1676 1448 AsyncClient.exe cmd.exe PID 1448 wrote to memory of 1676 1448 AsyncClient.exe cmd.exe PID 1448 wrote to memory of 1676 1448 AsyncClient.exe cmd.exe PID 1448 wrote to memory of 1308 1448 AsyncClient.exe cmd.exe PID 1448 wrote to memory of 1308 1448 AsyncClient.exe cmd.exe PID 1448 wrote to memory of 1308 1448 AsyncClient.exe cmd.exe PID 1448 wrote to memory of 1308 1448 AsyncClient.exe cmd.exe PID 1308 wrote to memory of 812 1308 cmd.exe timeout.exe PID 1308 wrote to memory of 812 1308 cmd.exe timeout.exe PID 1308 wrote to memory of 812 1308 cmd.exe timeout.exe PID 1308 wrote to memory of 812 1308 cmd.exe timeout.exe PID 1676 wrote to memory of 1508 1676 cmd.exe schtasks.exe PID 1676 wrote to memory of 1508 1676 cmd.exe schtasks.exe PID 1676 wrote to memory of 1508 1676 cmd.exe schtasks.exe PID 1676 wrote to memory of 1508 1676 cmd.exe schtasks.exe PID 1308 wrote to memory of 1816 1308 cmd.exe win.exe PID 1308 wrote to memory of 1816 1308 cmd.exe win.exe PID 1308 wrote to memory of 1816 1308 cmd.exe win.exe PID 1308 wrote to memory of 1816 1308 cmd.exe win.exe PID 1768 wrote to memory of 1480 1768 Exemama.exe powershell.exe PID 1768 wrote to memory of 1480 1768 Exemama.exe powershell.exe PID 1768 wrote to memory of 1480 1768 Exemama.exe powershell.exe PID 1768 wrote to memory of 1480 1768 Exemama.exe powershell.exe PID 1768 wrote to memory of 576 1768 Exemama.exe images.exe PID 1768 wrote to memory of 576 1768 Exemama.exe images.exe PID 1768 wrote to memory of 576 1768 Exemama.exe images.exe PID 1768 wrote to memory of 576 1768 Exemama.exe images.exe PID 576 wrote to memory of 1584 576 images.exe powershell.exe PID 576 wrote to memory of 1584 576 images.exe powershell.exe PID 576 wrote to memory of 1584 576 images.exe powershell.exe PID 576 wrote to memory of 1584 576 images.exe powershell.exe PID 576 wrote to memory of 1788 576 images.exe cmd.exe PID 576 wrote to memory of 1788 576 images.exe cmd.exe PID 576 wrote to memory of 1788 576 images.exe cmd.exe PID 576 wrote to memory of 1788 576 images.exe cmd.exe PID 576 wrote to memory of 1788 576 images.exe cmd.exe PID 576 wrote to memory of 1788 576 images.exe cmd.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Info.pdf.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.js"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp2DE5.tmp.bat""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Exemama.exe"C:\Users\Admin\AppData\Roaming\Exemama.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Local\Temp\tmp2DE5.tmp.batFilesize
147B
MD5e4cb87cd63337808a1a1cf6c01060178
SHA1e11cc586525cb873f4dbf7bde8bb7c8889b00323
SHA2563287ab9d27d13b212b4dcc315cbb7fc46ecb1d9e5057d6de37d87cb04a7b9231
SHA5126dfce2e68dc8d9a381809bee50d4e4d3cbf886dc5f55ad572e785f9d7788c2d67f1ab118ecf403e286ed4cbc377d3e6427f1318d6b62b815bb41d8a1b409da70
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.jsFilesize
89KB
MD5ee1a6922b6661ba75891fa7bf2711cbb
SHA1b189a0f5aae6163a6157800ae9051a207d72fb0c
SHA256399dadbfe84b0ecb6c65fcfabf384873be7234ad60b84cbaaf611f6c3ade71e0
SHA512edd614e4c8c36938ed0e5489cf0bed08645eda8b2cd2fb73f5e328348340922cc0f091dc059b737cf4ec23e0455f7009bc18992ef3330b81b6a847cf6d2cdcf3
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5348f224d23990a837ea063fc538f0fbc
SHA1379e564fd1cf7f02eda4316adeb439e6a1ae1104
SHA25620810cdfc73e3aaee60873092023f5c717a03c78bd4374a9dac0c7702c0f81da
SHA512436231b149bcf2dc36516ca21b363e2fec4d8c2d1a02c65d68608cf51a5ce4d9048aecfdcc687d2dc0108081e3afc7ebf87e438aed6aff181d98c64b6e2c06db
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/576-94-0x0000000002DB0000-0x0000000002EB0000-memory.dmpFilesize
1024KB
-
memory/576-80-0x0000000000000000-mapping.dmp
-
memory/812-69-0x0000000000000000-mapping.dmp
-
memory/1092-55-0x0000000000000000-mapping.dmp
-
memory/1308-67-0x0000000000000000-mapping.dmp
-
memory/1448-64-0x0000000000EB0000-0x0000000000EC2000-memory.dmpFilesize
72KB
-
memory/1448-60-0x0000000000000000-mapping.dmp
-
memory/1480-77-0x0000000000000000-mapping.dmp
-
memory/1480-85-0x0000000073B60000-0x000000007410B000-memory.dmpFilesize
5.7MB
-
memory/1480-86-0x0000000073B60000-0x000000007410B000-memory.dmpFilesize
5.7MB
-
memory/1508-70-0x0000000000000000-mapping.dmp
-
memory/1584-92-0x0000000071440000-0x00000000719EB000-memory.dmpFilesize
5.7MB
-
memory/1584-88-0x0000000000000000-mapping.dmp
-
memory/1676-66-0x0000000000000000-mapping.dmp
-
memory/1768-58-0x0000000000000000-mapping.dmp
-
memory/1768-62-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1788-89-0x0000000000000000-mapping.dmp
-
memory/1788-93-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1816-75-0x0000000001030000-0x0000000001042000-memory.dmpFilesize
72KB
-
memory/1816-73-0x0000000000000000-mapping.dmp
-
memory/1972-54-0x000007FEFC3A1000-0x000007FEFC3A3000-memory.dmpFilesize
8KB