Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-07-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Info.pdf.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipping Info.pdf.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
order.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
order.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Shipping Info.pdf.js
-
Size
374KB
-
MD5
1eb22e2b164c30a555d09c7537d74729
-
SHA1
db0e1a2b9604a2f70695b5749efcabd6ad0d517c
-
SHA256
e098dcf14cad6499677cbce1619ebf5ce683f45280ec95f20523319977dc8e61
-
SHA512
65b1062d62dba8b1e2707b14fd74ef2e46f7cdb494e28bb457167815b098ffd0ba6c13b2e353bf09173490e8ae0af5fc907db46b5b25c139b279d3f6d42bd172
Malware Config
Extracted
warzonerat
udooiuyt.dynamic-dns.net:5200
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Async RAT payload 7 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral1/memory/1136-64-0x0000000001150000-0x0000000001162000-memory.dmp asyncrat \Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat behavioral1/memory/836-75-0x0000000001350000-0x0000000001362000-memory.dmp asyncrat -
Warzone RAT Payload 6 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat \ProgramData\images.exe warzonerat \ProgramData\images.exe warzonerat C:\ProgramData\images.exe warzonerat C:\ProgramData\images.exe warzonerat -
Executes dropped EXE 4 IoCs
Processes:
Exemama.exeAsyncClient.exewin.exeimages.exepid process 1256 Exemama.exe 1136 AsyncClient.exe 836 win.exe 1940 images.exe -
Loads dropped DLL 3 IoCs
Processes:
cmd.exeExemama.exepid process 240 cmd.exe 1256 Exemama.exe 1256 Exemama.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Exemama.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" Exemama.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1636 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
AsyncClient.exepowershell.exepowershell.exepid process 1136 AsyncClient.exe 1700 powershell.exe 992 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AsyncClient.exewin.exepowershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1136 AsyncClient.exe Token: SeDebugPrivilege 836 win.exe Token: SeDebugPrivilege 1700 powershell.exe Token: SeDebugPrivilege 992 powershell.exe -
Suspicious use of WriteProcessMemory 49 IoCs
Processes:
wscript.exewscript.exeAsyncClient.execmd.execmd.exeExemama.exeimages.exedescription pid process target process PID 1172 wrote to memory of 1984 1172 wscript.exe wscript.exe PID 1172 wrote to memory of 1984 1172 wscript.exe wscript.exe PID 1172 wrote to memory of 1984 1172 wscript.exe wscript.exe PID 1172 wrote to memory of 1256 1172 wscript.exe Exemama.exe PID 1172 wrote to memory of 1256 1172 wscript.exe Exemama.exe PID 1172 wrote to memory of 1256 1172 wscript.exe Exemama.exe PID 1172 wrote to memory of 1256 1172 wscript.exe Exemama.exe PID 1984 wrote to memory of 1136 1984 wscript.exe AsyncClient.exe PID 1984 wrote to memory of 1136 1984 wscript.exe AsyncClient.exe PID 1984 wrote to memory of 1136 1984 wscript.exe AsyncClient.exe PID 1984 wrote to memory of 1136 1984 wscript.exe AsyncClient.exe PID 1136 wrote to memory of 764 1136 AsyncClient.exe cmd.exe PID 1136 wrote to memory of 764 1136 AsyncClient.exe cmd.exe PID 1136 wrote to memory of 764 1136 AsyncClient.exe cmd.exe PID 1136 wrote to memory of 764 1136 AsyncClient.exe cmd.exe PID 1136 wrote to memory of 240 1136 AsyncClient.exe cmd.exe PID 1136 wrote to memory of 240 1136 AsyncClient.exe cmd.exe PID 1136 wrote to memory of 240 1136 AsyncClient.exe cmd.exe PID 1136 wrote to memory of 240 1136 AsyncClient.exe cmd.exe PID 764 wrote to memory of 816 764 cmd.exe schtasks.exe PID 764 wrote to memory of 816 764 cmd.exe schtasks.exe PID 764 wrote to memory of 816 764 cmd.exe schtasks.exe PID 764 wrote to memory of 816 764 cmd.exe schtasks.exe PID 240 wrote to memory of 1636 240 cmd.exe timeout.exe PID 240 wrote to memory of 1636 240 cmd.exe timeout.exe PID 240 wrote to memory of 1636 240 cmd.exe timeout.exe PID 240 wrote to memory of 1636 240 cmd.exe timeout.exe PID 240 wrote to memory of 836 240 cmd.exe win.exe PID 240 wrote to memory of 836 240 cmd.exe win.exe PID 240 wrote to memory of 836 240 cmd.exe win.exe PID 240 wrote to memory of 836 240 cmd.exe win.exe PID 1256 wrote to memory of 1700 1256 Exemama.exe powershell.exe PID 1256 wrote to memory of 1700 1256 Exemama.exe powershell.exe PID 1256 wrote to memory of 1700 1256 Exemama.exe powershell.exe PID 1256 wrote to memory of 1700 1256 Exemama.exe powershell.exe PID 1256 wrote to memory of 1940 1256 Exemama.exe images.exe PID 1256 wrote to memory of 1940 1256 Exemama.exe images.exe PID 1256 wrote to memory of 1940 1256 Exemama.exe images.exe PID 1256 wrote to memory of 1940 1256 Exemama.exe images.exe PID 1940 wrote to memory of 992 1940 images.exe powershell.exe PID 1940 wrote to memory of 992 1940 images.exe powershell.exe PID 1940 wrote to memory of 992 1940 images.exe powershell.exe PID 1940 wrote to memory of 992 1940 images.exe powershell.exe PID 1940 wrote to memory of 1544 1940 images.exe cmd.exe PID 1940 wrote to memory of 1544 1940 images.exe cmd.exe PID 1940 wrote to memory of 1544 1940 images.exe cmd.exe PID 1940 wrote to memory of 1544 1940 images.exe cmd.exe PID 1940 wrote to memory of 1544 1940 images.exe cmd.exe PID 1940 wrote to memory of 1544 1940 images.exe cmd.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Info.pdf.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.js"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp6FD4.tmp.bat""4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Exemama.exe"C:\Users\Admin\AppData\Roaming\Exemama.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Local\Temp\tmp6FD4.tmp.batFilesize
147B
MD5de13963b61780f39289d8b73f7da712b
SHA18c71940efb7cf2a497cc61c28dda666cddc3880e
SHA256558e40de6138ced3d4feaf3cb594aff55572b73082ec12621d34ebfdd90dc6d9
SHA51213bdd24b3b790df4ced2582712d221d1a65de4140fc6725dda0cd30d0bec37dd376548f0dcb2c36a66cc0b7e0ef2961210e9308956207208a48dd156b2f0786d
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.jsFilesize
89KB
MD5ee1a6922b6661ba75891fa7bf2711cbb
SHA1b189a0f5aae6163a6157800ae9051a207d72fb0c
SHA256399dadbfe84b0ecb6c65fcfabf384873be7234ad60b84cbaaf611f6c3ade71e0
SHA512edd614e4c8c36938ed0e5489cf0bed08645eda8b2cd2fb73f5e328348340922cc0f091dc059b737cf4ec23e0455f7009bc18992ef3330b81b6a847cf6d2cdcf3
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-msFilesize
7KB
MD5c87dcab4d0b3526fe09b2971493b399d
SHA10b73d3c47a0ce4ba58c2565f1d4e1f9e72cece7b
SHA25639202a0a3919191f5f29fa3324686747ff9056e833fe49cee1075931ec6eb95a
SHA512d177fa8613fea5ec75409970bc3f78078b82db2926765e0791cb7dd093d32f252f1a0629337f15c6a16fffcd018e5afa7a39cd3e0e97fb5bfce65707698afbfa
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/240-67-0x0000000000000000-mapping.dmp
-
memory/764-66-0x0000000000000000-mapping.dmp
-
memory/816-68-0x0000000000000000-mapping.dmp
-
memory/836-73-0x0000000000000000-mapping.dmp
-
memory/836-75-0x0000000001350000-0x0000000001362000-memory.dmpFilesize
72KB
-
memory/992-92-0x000000006FFB0000-0x000000007055B000-memory.dmpFilesize
5.7MB
-
memory/992-88-0x0000000000000000-mapping.dmp
-
memory/1136-64-0x0000000001150000-0x0000000001162000-memory.dmpFilesize
72KB
-
memory/1136-60-0x0000000000000000-mapping.dmp
-
memory/1172-54-0x000007FEFBBD1000-0x000007FEFBBD3000-memory.dmpFilesize
8KB
-
memory/1256-58-0x0000000000000000-mapping.dmp
-
memory/1256-62-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/1544-89-0x0000000000000000-mapping.dmp
-
memory/1544-93-0x00000000000B0000-0x00000000000B1000-memory.dmpFilesize
4KB
-
memory/1636-70-0x0000000000000000-mapping.dmp
-
memory/1700-85-0x0000000070390000-0x000000007093B000-memory.dmpFilesize
5.7MB
-
memory/1700-86-0x0000000070390000-0x000000007093B000-memory.dmpFilesize
5.7MB
-
memory/1700-78-0x0000000000000000-mapping.dmp
-
memory/1940-82-0x0000000000000000-mapping.dmp
-
memory/1984-55-0x0000000000000000-mapping.dmp