Analysis
-
max time kernel
161s -
max time network
178s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
submitted
26-07-2022 07:42
General
-
Target
SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
-
Size
888KB
-
MD5
1bcd34738e63d6e4c67d56a5ab8d3cd0
-
SHA1
8c8ee03272b9ec906ec060b39dd1b2ac0e820323
-
SHA256
20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e
-
SHA512
a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1
Malware Config
Extracted
warzonerat
51.195.145.82:5252
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA930.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
18KB
MD532372bfda0f860418db86450740c7e98
SHA1ffea70f985c50f62b13071fab6cfb9c0fc9ab1d9
SHA2567ab340d93f3456b1fee684181de8c0ee7d85406ec67fa630e93b1c55401dc820
SHA512464a184c9a01fab9aaf014953af299b8cc4c56e96f2d398a7d9a0bab35ca39503dcd35227d125b13080ede5f8645be0126a663bea8635b62b7a6b91294eaae80
-
C:\Users\Admin\AppData\Local\Temp\tmpA930.tmpFilesize
1KB
MD55bbd1af9ade80dad3120943ad9792dfc
SHA147caad8f37f26e15df2d7627313e8cb4037bdff5
SHA256683b515da446ac70fafaed94b50706d5b808c8caada02eb0680efb97c852d123
SHA51260ace9137c7629ff2302a8683daba35a4314b80822808de52e4d73fb2debd50b9c9e7727773270d92291382239eb615fcbf3e175f9c4375d860302a1dac97f6e
-
memory/1572-161-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/1572-145-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/1572-147-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/1572-149-0x0000000000400000-0x000000000055A000-memory.dmpFilesize
1.4MB
-
memory/1572-144-0x0000000000000000-mapping.dmp
-
memory/4204-139-0x0000000000000000-mapping.dmp
-
memory/4292-130-0x0000000000490000-0x0000000000574000-memory.dmpFilesize
912KB
-
memory/4292-135-0x000000000B590000-0x000000000B5F6000-memory.dmpFilesize
408KB
-
memory/4292-134-0x0000000008A50000-0x0000000008AEC000-memory.dmpFilesize
624KB
-
memory/4292-133-0x00000000050C0000-0x00000000050CA000-memory.dmpFilesize
40KB
-
memory/4292-132-0x0000000004F00000-0x0000000004F92000-memory.dmpFilesize
584KB
-
memory/4292-131-0x0000000005560000-0x0000000005B04000-memory.dmpFilesize
5.6MB
-
memory/4584-155-0x0000000007430000-0x0000000007AAA000-memory.dmpFilesize
6.5MB
-
memory/4584-157-0x0000000007070000-0x0000000007106000-memory.dmpFilesize
600KB
-
memory/4584-141-0x0000000004A20000-0x0000000004A42000-memory.dmpFilesize
136KB
-
memory/4584-137-0x0000000000000000-mapping.dmp
-
memory/4584-160-0x0000000007110000-0x0000000007118000-memory.dmpFilesize
32KB
-
memory/4584-159-0x0000000007130000-0x000000000714A000-memory.dmpFilesize
104KB
-
memory/4584-152-0x0000000070BE0000-0x0000000070C2C000-memory.dmpFilesize
304KB
-
memory/5104-154-0x0000000007780000-0x000000000779A000-memory.dmpFilesize
104KB
-
memory/5104-153-0x0000000006A40000-0x0000000006A5E000-memory.dmpFilesize
120KB
-
memory/5104-143-0x0000000005660000-0x00000000056C6000-memory.dmpFilesize
408KB
-
memory/5104-138-0x0000000004ED0000-0x0000000004F06000-memory.dmpFilesize
216KB
-
memory/5104-156-0x00000000077F0000-0x00000000077FA000-memory.dmpFilesize
40KB
-
memory/5104-151-0x0000000070BE0000-0x0000000070C2C000-memory.dmpFilesize
304KB
-
memory/5104-158-0x00000000079C0000-0x00000000079CE000-memory.dmpFilesize
56KB
-
memory/5104-150-0x0000000006A60000-0x0000000006A92000-memory.dmpFilesize
200KB
-
memory/5104-140-0x00000000056E0000-0x0000000005D08000-memory.dmpFilesize
6.2MB
-
memory/5104-148-0x0000000006480000-0x000000000649E000-memory.dmpFilesize
120KB
-
memory/5104-136-0x0000000000000000-mapping.dmp