Overview

overview

10

Static

static

SecuriteIn...19.exe

windows7-x64

10

SecuriteIn...19.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    138s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220715-en
  • submitted
    26-07-2022 07:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

  • Size

    888KB

  • MD5

    1bcd34738e63d6e4c67d56a5ab8d3cd0

  • SHA1

    8c8ee03272b9ec906ec060b39dd1b2ac0e820323

  • SHA256

    20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e

  • SHA512

    a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1

Score
10/10
warzoneratinfostealerrat

Malware Config

Extracted

Family

warzonerat

C2

51.195.145.82:5252

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzone RAT payload 8 IoCs
    rat
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:588
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1156
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:936
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1984
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
      2⤵
        PID:1644
      • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
        "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
        2⤵
          PID:1344

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Scheduled Task

      1
      T1053

      Persistence

      Scheduled Task

      1
      T1053

      Privilege Escalation

      Scheduled Task

      1
      T1053

      Defense Evasion

      Credential Access

      Discovery

      System Information Discovery

      1
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp
        Filesize

        1KB

        MD5

        ce6bbbed227f81810a56f4abeb68c8da

        SHA1

        70dcc16c3fb54d8e36701621dfc69a7edeeb1f15

        SHA256

        1cc471481f27c50a91c6a35959d48d0e70ed854ce6f2635bc5d298908565ad02

        SHA512

        658bdc18c6ebb4cc3ae051022f59ba77fd07b1f867f038b5604fc13edb71583508291d4f2a740dfde356b742f5eece3a991c42a9d782568f76523232ef32e4d3

        Download Submit
      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
        Filesize

        7KB

        MD5

        67486f580f900d97ca310d542e3d5dbe

        SHA1

        99470cd9e53f1b653a7d7f42685773fc6d66a259

        SHA256

        da297c8adec105e47c743916fd2d48f379f42380327bcf9db5717f6ff0e269e1

        SHA512

        4d5a0a1feacefcd17cc7195002787c09d0f951a9fc87d26ac3ac0fc55f3d444ca0119fc8ecf68de8c160986b0d4c44a8b95cf2e6fb1b03656a67abc41804d90d

        Download Submit
      • memory/588-57-0x0000000000250000-0x000000000025A000-memory.dmp
        Filesize

        40KB

        Download
      • memory/588-58-0x0000000005E40000-0x0000000005EBA000-memory.dmp
        Filesize

        488KB

        Download
      • memory/588-56-0x0000000000240000-0x0000000000256000-memory.dmp
        Filesize

        88KB

        Download
      • memory/588-55-0x0000000076231000-0x0000000076233000-memory.dmp
        Filesize

        8KB

        Download
      • memory/588-66-0x0000000002350000-0x000000000237C000-memory.dmp
        Filesize

        176KB

        Download
      • memory/588-54-0x0000000000B30000-0x0000000000C14000-memory.dmp
        Filesize

        912KB

        Download
      • memory/936-61-0x0000000000000000-mapping.dmp
        Download
      • memory/936-86-0x000000006F600000-0x000000006FBAB000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/936-84-0x000000006F600000-0x000000006FBAB000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/1156-83-0x000000006F600000-0x000000006FBAB000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/1156-59-0x0000000000000000-mapping.dmp
        Download
      • memory/1156-87-0x000000006F600000-0x000000006FBAB000-memory.dmp
        Filesize

        5.7MB

        Download
      • memory/1344-68-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-72-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-75-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-77-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-79-0x0000000000406DA4-mapping.dmp
        Download
      • memory/1344-78-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-82-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-73-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-70-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-85-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1344-67-0x0000000000400000-0x000000000055A000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1984-62-0x0000000000000000-mapping.dmp
        Download