Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 09:52
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Info.pdf.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipping Info.pdf.js
Resource
win10v2004-20220414-en
General
-
Target
Shipping Info.pdf.js
-
Size
374KB
-
MD5
1eb22e2b164c30a555d09c7537d74729
-
SHA1
db0e1a2b9604a2f70695b5749efcabd6ad0d517c
-
SHA256
e098dcf14cad6499677cbce1619ebf5ce683f45280ec95f20523319977dc8e61
-
SHA512
65b1062d62dba8b1e2707b14fd74ef2e46f7cdb494e28bb457167815b098ffd0ba6c13b2e353bf09173490e8ae0af5fc907db46b5b25c139b279d3f6d42bd172
Malware Config
Extracted
warzonerat
udooiuyt.dynamic-dns.net:5200
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
-
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral2/memory/4792-138-0x0000000000EE0000-0x0000000000EF2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat -
Warzone RAT Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat C:\ProgramData\images.exe warzonerat C:\ProgramData\images.exe warzonerat -
Executes dropped EXE 4 IoCs
Processes:
AsyncClient.exeExemama.exeimages.exewin.exepid process 4792 AsyncClient.exe 4756 Exemama.exe 4624 images.exe 4992 win.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
AsyncClient.exewscript.exewscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation AsyncClient.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation wscript.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Exemama.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" Exemama.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 3496 timeout.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
powershell.exepowershell.exeAsyncClient.exepid process 4852 powershell.exe 4852 powershell.exe 3228 powershell.exe 3228 powershell.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe 4792 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exeAsyncClient.exewin.exedescription pid process Token: SeDebugPrivilege 4852 powershell.exe Token: SeDebugPrivilege 3228 powershell.exe Token: SeDebugPrivilege 4792 AsyncClient.exe Token: SeDebugPrivilege 4992 win.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
images.exepid process 4624 images.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
wscript.exewscript.exeExemama.exeimages.exeAsyncClient.execmd.execmd.exedescription pid process target process PID 4036 wrote to memory of 3548 4036 wscript.exe wscript.exe PID 4036 wrote to memory of 3548 4036 wscript.exe wscript.exe PID 3548 wrote to memory of 4792 3548 wscript.exe AsyncClient.exe PID 3548 wrote to memory of 4792 3548 wscript.exe AsyncClient.exe PID 3548 wrote to memory of 4792 3548 wscript.exe AsyncClient.exe PID 4036 wrote to memory of 4756 4036 wscript.exe Exemama.exe PID 4036 wrote to memory of 4756 4036 wscript.exe Exemama.exe PID 4036 wrote to memory of 4756 4036 wscript.exe Exemama.exe PID 4756 wrote to memory of 4852 4756 Exemama.exe powershell.exe PID 4756 wrote to memory of 4852 4756 Exemama.exe powershell.exe PID 4756 wrote to memory of 4852 4756 Exemama.exe powershell.exe PID 4756 wrote to memory of 4624 4756 Exemama.exe images.exe PID 4756 wrote to memory of 4624 4756 Exemama.exe images.exe PID 4756 wrote to memory of 4624 4756 Exemama.exe images.exe PID 4624 wrote to memory of 3228 4624 images.exe powershell.exe PID 4624 wrote to memory of 3228 4624 images.exe powershell.exe PID 4624 wrote to memory of 3228 4624 images.exe powershell.exe PID 4624 wrote to memory of 4676 4624 images.exe cmd.exe PID 4624 wrote to memory of 4676 4624 images.exe cmd.exe PID 4624 wrote to memory of 4676 4624 images.exe cmd.exe PID 4624 wrote to memory of 4676 4624 images.exe cmd.exe PID 4624 wrote to memory of 4676 4624 images.exe cmd.exe PID 4792 wrote to memory of 2464 4792 AsyncClient.exe cmd.exe PID 4792 wrote to memory of 2464 4792 AsyncClient.exe cmd.exe PID 4792 wrote to memory of 2464 4792 AsyncClient.exe cmd.exe PID 4792 wrote to memory of 688 4792 AsyncClient.exe cmd.exe PID 4792 wrote to memory of 688 4792 AsyncClient.exe cmd.exe PID 4792 wrote to memory of 688 4792 AsyncClient.exe cmd.exe PID 2464 wrote to memory of 3192 2464 cmd.exe schtasks.exe PID 2464 wrote to memory of 3192 2464 cmd.exe schtasks.exe PID 2464 wrote to memory of 3192 2464 cmd.exe schtasks.exe PID 688 wrote to memory of 3496 688 cmd.exe timeout.exe PID 688 wrote to memory of 3496 688 cmd.exe timeout.exe PID 688 wrote to memory of 3496 688 cmd.exe timeout.exe PID 688 wrote to memory of 4992 688 cmd.exe win.exe PID 688 wrote to memory of 4992 688 cmd.exe win.exe PID 688 wrote to memory of 4992 688 cmd.exe win.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Info.pdf.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.js"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp87D2.tmp.bat""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Exemama.exe"C:\Users\Admin\AppData\Roaming\Exemama.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD53e89cd5b0cb936338b26f2ffbccb2023
SHA157d0e8fae7e1f116aef17a2218254a20b8646d82
SHA2563e60e109fabfc8c8efd428c00cba26c743235003e7eae9c5147d90e6996363bb
SHA51267ff3ac5007c53248834c4d44145ec44b3414ca2c27296dbec6da79309ab5e126986104ccb5e435b8bb13fbc07af82fda0cacc866a20d9e05f241722d5c25706
-
C:\Users\Admin\AppData\Local\Temp\tmp87D2.tmp.batFilesize
147B
MD509e787ea90c9d67fd9070c49be9fb83b
SHA17ef046de1e126a30478a766fb91133c42dd03c93
SHA2561a73d9a8815e44518b007588e0166ed5b4ab9d1c9e323c6c07387b9edbd0804b
SHA512190a9623b78dce74908105aa8a5bd271c3c9d75aee7e7dce83d7c42496c66301fe1905e4a86f7c4e3fe20d2850becbaf08f4fad29b31618fab18b5dbb73616c1
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.jsFilesize
89KB
MD5ee1a6922b6661ba75891fa7bf2711cbb
SHA1b189a0f5aae6163a6157800ae9051a207d72fb0c
SHA256399dadbfe84b0ecb6c65fcfabf384873be7234ad60b84cbaaf611f6c3ade71e0
SHA512edd614e4c8c36938ed0e5489cf0bed08645eda8b2cd2fb73f5e328348340922cc0f091dc059b737cf4ec23e0455f7009bc18992ef3330b81b6a847cf6d2cdcf3
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/688-154-0x0000000000000000-mapping.dmp
-
memory/2464-153-0x0000000000000000-mapping.dmp
-
memory/3192-158-0x0000000000000000-mapping.dmp
-
memory/3228-170-0x0000000007870000-0x000000000788A000-memory.dmpFilesize
104KB
-
memory/3228-171-0x0000000007850000-0x0000000007858000-memory.dmpFilesize
32KB
-
memory/3228-169-0x0000000007760000-0x000000000776E000-memory.dmpFilesize
56KB
-
memory/3228-148-0x0000000000000000-mapping.dmp
-
memory/3228-159-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/3228-162-0x0000000007C00000-0x000000000827A000-memory.dmpFilesize
6.5MB
-
memory/3228-167-0x00000000075A0000-0x00000000075AA000-memory.dmpFilesize
40KB
-
memory/3496-161-0x0000000000000000-mapping.dmp
-
memory/3548-130-0x0000000000000000-mapping.dmp
-
memory/4624-140-0x0000000000000000-mapping.dmp
-
memory/4624-174-0x0000000004140000-0x00000000042E0000-memory.dmpFilesize
1.6MB
-
memory/4676-151-0x0000000000B00000-0x0000000000B01000-memory.dmpFilesize
4KB
-
memory/4676-149-0x0000000000000000-mapping.dmp
-
memory/4756-133-0x0000000000000000-mapping.dmp
-
memory/4792-152-0x0000000005910000-0x00000000059AC000-memory.dmpFilesize
624KB
-
memory/4792-138-0x0000000000EE0000-0x0000000000EF2000-memory.dmpFilesize
72KB
-
memory/4792-132-0x0000000000000000-mapping.dmp
-
memory/4852-147-0x00000000055B0000-0x0000000005616000-memory.dmpFilesize
408KB
-
memory/4852-163-0x0000000006EF0000-0x0000000006F0A000-memory.dmpFilesize
104KB
-
memory/4852-150-0x0000000005BE0000-0x0000000005BFE000-memory.dmpFilesize
120KB
-
memory/4852-157-0x0000000006190000-0x00000000061AE000-memory.dmpFilesize
120KB
-
memory/4852-146-0x00000000054D0000-0x0000000005536000-memory.dmpFilesize
408KB
-
memory/4852-168-0x0000000007180000-0x0000000007216000-memory.dmpFilesize
600KB
-
memory/4852-145-0x0000000005370000-0x0000000005392000-memory.dmpFilesize
136KB
-
memory/4852-144-0x0000000004D40000-0x0000000005368000-memory.dmpFilesize
6.2MB
-
memory/4852-143-0x0000000000E90000-0x0000000000EC6000-memory.dmpFilesize
216KB
-
memory/4852-139-0x0000000000000000-mapping.dmp
-
memory/4852-155-0x0000000006BA0000-0x0000000006BD2000-memory.dmpFilesize
200KB
-
memory/4852-156-0x00000000707E0000-0x000000007082C000-memory.dmpFilesize
304KB
-
memory/4992-164-0x0000000000000000-mapping.dmp