Analysis

  • max time kernel
    138s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • submitted
    26-07-2022 07:42

General

  • Target

    SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

  • Size

    888KB

  • MD5

    1bcd34738e63d6e4c67d56a5ab8d3cd0

  • SHA1

    8c8ee03272b9ec906ec060b39dd1b2ac0e820323

  • SHA256

    20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e

  • SHA512

    a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1

Malware Config

Extracted

Family

warzonerat

C2

51.195.145.82:5252

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload ⋅ 8 IoCs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 10 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:588
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1156
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:936
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp"
      Creates scheduled task(s)
      PID:1984
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
      PID:1644
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
      PID:1344

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp
                        MD5

                        ce6bbbed227f81810a56f4abeb68c8da

                        SHA1

                        70dcc16c3fb54d8e36701621dfc69a7edeeb1f15

                        SHA256

                        1cc471481f27c50a91c6a35959d48d0e70ed854ce6f2635bc5d298908565ad02

                        SHA512

                        658bdc18c6ebb4cc3ae051022f59ba77fd07b1f867f038b5604fc13edb71583508291d4f2a740dfde356b742f5eece3a991c42a9d782568f76523232ef32e4d3

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
                        MD5

                        67486f580f900d97ca310d542e3d5dbe

                        SHA1

                        99470cd9e53f1b653a7d7f42685773fc6d66a259

                        SHA256

                        da297c8adec105e47c743916fd2d48f379f42380327bcf9db5717f6ff0e269e1

                        SHA512

                        4d5a0a1feacefcd17cc7195002787c09d0f951a9fc87d26ac3ac0fc55f3d444ca0119fc8ecf68de8c160986b0d4c44a8b95cf2e6fb1b03656a67abc41804d90d

                      • memory/588-57-0x0000000000250000-0x000000000025A000-memory.dmp
                      • memory/588-58-0x0000000005E40000-0x0000000005EBA000-memory.dmp
                      • memory/588-56-0x0000000000240000-0x0000000000256000-memory.dmp
                      • memory/588-55-0x0000000076231000-0x0000000076233000-memory.dmp
                      • memory/588-66-0x0000000002350000-0x000000000237C000-memory.dmp
                      • memory/588-54-0x0000000000B30000-0x0000000000C14000-memory.dmp
                      • memory/936-61-0x0000000000000000-mapping.dmp
                      • memory/936-86-0x000000006F600000-0x000000006FBAB000-memory.dmp
                      • memory/936-84-0x000000006F600000-0x000000006FBAB000-memory.dmp
                      • memory/1156-83-0x000000006F600000-0x000000006FBAB000-memory.dmp
                      • memory/1156-59-0x0000000000000000-mapping.dmp
                      • memory/1156-87-0x000000006F600000-0x000000006FBAB000-memory.dmp
                      • memory/1344-68-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-72-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-75-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-77-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-79-0x0000000000406DA4-mapping.dmp
                      • memory/1344-78-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-82-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-73-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-70-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-85-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1344-67-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1984-62-0x0000000000000000-mapping.dmp