Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
04-07-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
Shipping Info.pdf.js
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
Shipping Info.pdf.js
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
order.pdf.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
order.pdf.exe
Resource
win10v2004-20220414-en
General
-
Target
Shipping Info.pdf.js
-
Size
374KB
-
MD5
1eb22e2b164c30a555d09c7537d74729
-
SHA1
db0e1a2b9604a2f70695b5749efcabd6ad0d517c
-
SHA256
e098dcf14cad6499677cbce1619ebf5ce683f45280ec95f20523319977dc8e61
-
SHA512
65b1062d62dba8b1e2707b14fd74ef2e46f7cdb494e28bb457167815b098ffd0ba6c13b2e353bf09173490e8ae0af5fc907db46b5b25c139b279d3f6d42bd172
Malware Config
Extracted
warzonerat
udooiuyt.dynamic-dns.net:5200
Extracted
asyncrat
0.5.7B
Default
franmhort.duia.ro:8153
Mutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
win.exe
-
install_folder
%AppData%
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Async RAT payload 5 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat C:\Users\Admin\AppData\Roaming\AsyncClient.exe asyncrat behavioral2/memory/4544-138-0x0000000000DD0000-0x0000000000DE2000-memory.dmp asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat C:\Users\Admin\AppData\Roaming\win.exe asyncrat -
Warzone RAT Payload 4 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat C:\Users\Admin\AppData\Roaming\Exemama.exe warzonerat C:\ProgramData\images.exe warzonerat C:\ProgramData\images.exe warzonerat -
Executes dropped EXE 4 IoCs
Processes:
Exemama.exeAsyncClient.exeimages.exewin.exepid process 544 Exemama.exe 4544 AsyncClient.exe 4736 images.exe 3596 win.exe -
Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exewscript.exeAsyncClient.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation wscript.exe Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation AsyncClient.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
Exemama.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" Exemama.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 5032 timeout.exe -
Suspicious behavior: EnumeratesProcesses 27 IoCs
Processes:
powershell.exepowershell.exeAsyncClient.exepid process 4496 powershell.exe 4140 powershell.exe 4496 powershell.exe 4140 powershell.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe 4544 AsyncClient.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.exepowershell.exeAsyncClient.exewin.exedescription pid process Token: SeDebugPrivilege 4496 powershell.exe Token: SeDebugPrivilege 4140 powershell.exe Token: SeDebugPrivilege 4544 AsyncClient.exe Token: SeDebugPrivilege 3596 win.exe -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
wscript.exewscript.exeExemama.exeimages.exeAsyncClient.execmd.execmd.exedescription pid process target process PID 4216 wrote to memory of 3100 4216 wscript.exe wscript.exe PID 4216 wrote to memory of 3100 4216 wscript.exe wscript.exe PID 4216 wrote to memory of 544 4216 wscript.exe Exemama.exe PID 4216 wrote to memory of 544 4216 wscript.exe Exemama.exe PID 4216 wrote to memory of 544 4216 wscript.exe Exemama.exe PID 3100 wrote to memory of 4544 3100 wscript.exe AsyncClient.exe PID 3100 wrote to memory of 4544 3100 wscript.exe AsyncClient.exe PID 3100 wrote to memory of 4544 3100 wscript.exe AsyncClient.exe PID 544 wrote to memory of 4496 544 Exemama.exe powershell.exe PID 544 wrote to memory of 4496 544 Exemama.exe powershell.exe PID 544 wrote to memory of 4496 544 Exemama.exe powershell.exe PID 544 wrote to memory of 4736 544 Exemama.exe images.exe PID 544 wrote to memory of 4736 544 Exemama.exe images.exe PID 544 wrote to memory of 4736 544 Exemama.exe images.exe PID 4736 wrote to memory of 4140 4736 images.exe powershell.exe PID 4736 wrote to memory of 4140 4736 images.exe powershell.exe PID 4736 wrote to memory of 4140 4736 images.exe powershell.exe PID 4736 wrote to memory of 1148 4736 images.exe cmd.exe PID 4736 wrote to memory of 1148 4736 images.exe cmd.exe PID 4736 wrote to memory of 1148 4736 images.exe cmd.exe PID 4736 wrote to memory of 1148 4736 images.exe cmd.exe PID 4736 wrote to memory of 1148 4736 images.exe cmd.exe PID 4544 wrote to memory of 4100 4544 AsyncClient.exe cmd.exe PID 4544 wrote to memory of 4100 4544 AsyncClient.exe cmd.exe PID 4544 wrote to memory of 4100 4544 AsyncClient.exe cmd.exe PID 4544 wrote to memory of 3608 4544 AsyncClient.exe cmd.exe PID 4544 wrote to memory of 3608 4544 AsyncClient.exe cmd.exe PID 4544 wrote to memory of 3608 4544 AsyncClient.exe cmd.exe PID 4100 wrote to memory of 3180 4100 cmd.exe schtasks.exe PID 4100 wrote to memory of 3180 4100 cmd.exe schtasks.exe PID 4100 wrote to memory of 3180 4100 cmd.exe schtasks.exe PID 3608 wrote to memory of 5032 3608 cmd.exe timeout.exe PID 3608 wrote to memory of 5032 3608 cmd.exe timeout.exe PID 3608 wrote to memory of 5032 3608 cmd.exe timeout.exe PID 3608 wrote to memory of 3596 3608 cmd.exe win.exe PID 3608 wrote to memory of 3596 3608 cmd.exe win.exe PID 3608 wrote to memory of 3596 3608 cmd.exe win.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Shipping Info.pdf.js"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.js"2⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exe"C:\Users\Admin\AppData\Roaming\AsyncClient.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "win" /tr '"C:\Users\Admin\AppData\Roaming\win.exe"'5⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDBFD.tmp.bat""4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 35⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Roaming\win.exe"C:\Users\Admin\AppData\Roaming\win.exe"5⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\Exemama.exe"C:\Users\Admin\AppData\Roaming\Exemama.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exe"C:\ProgramData\images.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\ProgramData\images.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD588d338d02bf1042d5b64c609cc6f2b1f
SHA1f7c488c640a879e955b394d78392bce2551f8de7
SHA256e3671b734da72172177d10daffcecfa8bb0f8275b068ffe3aa0b09482229fe9a
SHA512b4b3b40406f69df843bae4e18d3cb01de898df788079da3d4b81e90862718e9fb5daf0dab3e099e94aef05f538ca45e97dbea7ff59f2bdf03717cce47cf1f438
-
C:\Users\Admin\AppData\Local\Temp\tmpDBFD.tmp.batFilesize
147B
MD593a44a63871dae1b075a5ed835e9a910
SHA1234895c1e6595786bf6b9e59d2e536a26ab59f61
SHA256dcc1d7cd1344acbc2b3b8d9e1f7ae18a2a9f616dbe8e34de5834279beaaca64f
SHA5121d44654ff0584aff1b4107ed571afbac064054fd84da9f821d83145cc2c08d3c49f764d4243980dbd3407f3b768ccc758395d8e06cd08ff29fa01e4710ee2115
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\AsyncClient.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\BHKIZRGxTd.jsFilesize
89KB
MD5ee1a6922b6661ba75891fa7bf2711cbb
SHA1b189a0f5aae6163a6157800ae9051a207d72fb0c
SHA256399dadbfe84b0ecb6c65fcfabf384873be7234ad60b84cbaaf611f6c3ade71e0
SHA512edd614e4c8c36938ed0e5489cf0bed08645eda8b2cd2fb73f5e328348340922cc0f091dc059b737cf4ec23e0455f7009bc18992ef3330b81b6a847cf6d2cdcf3
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\Exemama.exeFilesize
113KB
MD52b66b672e8e821b5f31c499679d865f1
SHA10a89f829f5d477538e412a929b876f4bf17f21dc
SHA2562f9ec3d178213d5f97668cc78eca26bdad67afd933ad441db0718fa629a6bbfe
SHA51260a014cf80a7dc3392e67e51f91530cf418d24c4cfd3c7fa65bb24be928a8f55e41fe68384d1d56790aa9bac7dc7a7745a36abc910877860457fd873d1a5eeb0
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
C:\Users\Admin\AppData\Roaming\win.exeFilesize
45KB
MD5cbdce3b5e2939fe92312004dcb31151f
SHA16f11f275c611decd4659f23a4593103f327806a6
SHA2566ccc49875c2d837f462c4c3bd81f80b3be93f8435e8a22e042b5db025a31a6e3
SHA5126240f21957016db0607987c81b110e78640d20eeba2dc0274cf6e6741cfd7924ca3b42325405e620f423157c34f355f188dbf60de96421e87f0d53e271fcc2c8
-
memory/544-132-0x0000000000000000-mapping.dmp
-
memory/1148-150-0x0000000001080000-0x0000000001081000-memory.dmpFilesize
4KB
-
memory/1148-146-0x0000000000000000-mapping.dmp
-
memory/3100-130-0x0000000000000000-mapping.dmp
-
memory/3180-156-0x0000000000000000-mapping.dmp
-
memory/3596-169-0x0000000000000000-mapping.dmp
-
memory/3608-154-0x0000000000000000-mapping.dmp
-
memory/4100-153-0x0000000000000000-mapping.dmp
-
memory/4140-163-0x0000000007250000-0x000000000726A000-memory.dmpFilesize
104KB
-
memory/4140-166-0x0000000007480000-0x000000000748E000-memory.dmpFilesize
56KB
-
memory/4140-168-0x0000000007570000-0x0000000007578000-memory.dmpFilesize
32KB
-
memory/4140-151-0x0000000005F50000-0x0000000005F6E000-memory.dmpFilesize
120KB
-
memory/4140-165-0x00000000074D0000-0x0000000007566000-memory.dmpFilesize
600KB
-
memory/4140-164-0x00000000072C0000-0x00000000072CA000-memory.dmpFilesize
40KB
-
memory/4140-162-0x00000000078A0000-0x0000000007F1A000-memory.dmpFilesize
6.5MB
-
memory/4140-145-0x0000000000000000-mapping.dmp
-
memory/4140-158-0x0000000006520000-0x0000000006552000-memory.dmpFilesize
200KB
-
memory/4140-159-0x0000000072680000-0x00000000726CC000-memory.dmpFilesize
304KB
-
memory/4140-160-0x0000000006500000-0x000000000651E000-memory.dmpFilesize
120KB
-
memory/4496-147-0x00000000055A0000-0x00000000055C2000-memory.dmpFilesize
136KB
-
memory/4496-144-0x0000000004F70000-0x0000000005598000-memory.dmpFilesize
6.2MB
-
memory/4496-148-0x0000000005740000-0x00000000057A6000-memory.dmpFilesize
408KB
-
memory/4496-149-0x0000000005820000-0x0000000005886000-memory.dmpFilesize
408KB
-
memory/4496-167-0x0000000007480000-0x000000000749A000-memory.dmpFilesize
104KB
-
memory/4496-143-0x0000000002520000-0x0000000002556000-memory.dmpFilesize
216KB
-
memory/4496-161-0x0000000072680000-0x00000000726CC000-memory.dmpFilesize
304KB
-
memory/4496-139-0x0000000000000000-mapping.dmp
-
memory/4544-138-0x0000000000DD0000-0x0000000000DE2000-memory.dmpFilesize
72KB
-
memory/4544-135-0x0000000000000000-mapping.dmp
-
memory/4544-152-0x0000000005940000-0x00000000059DC000-memory.dmpFilesize
624KB
-
memory/4736-140-0x0000000000000000-mapping.dmp
-
memory/5032-157-0x0000000000000000-mapping.dmp