Analysis

  • max time kernel
    161s
  • max time network
    178s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • submitted
    26-07-2022 07:42

General

  • Target

    SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

  • Size

    888KB

  • MD5

    1bcd34738e63d6e4c67d56a5ab8d3cd0

  • SHA1

    8c8ee03272b9ec906ec060b39dd1b2ac0e820323

  • SHA256

    20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e

  • SHA512

    a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1

Malware Config

Extracted

Family

warzonerat

C2

51.195.145.82:5252

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT payload ⋅ 4 IoCs
  • Checks computer location settings ⋅ 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) ⋅ 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses ⋅ 11 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 3 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
    Checks computer location settings
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5104
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4584
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA930.tmp"
      Creates scheduled task(s)
      PID:4204
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
      PID:1572

Network

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

          Execution

            Exfiltration

              Impact

                Initial Access

                  Lateral Movement

                    Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                        MD5

                        32372bfda0f860418db86450740c7e98

                        SHA1

                        ffea70f985c50f62b13071fab6cfb9c0fc9ab1d9

                        SHA256

                        7ab340d93f3456b1fee684181de8c0ee7d85406ec67fa630e93b1c55401dc820

                        SHA512

                        464a184c9a01fab9aaf014953af299b8cc4c56e96f2d398a7d9a0bab35ca39503dcd35227d125b13080ede5f8645be0126a663bea8635b62b7a6b91294eaae80

                      • C:\Users\Admin\AppData\Local\Temp\tmpA930.tmp
                        MD5

                        5bbd1af9ade80dad3120943ad9792dfc

                        SHA1

                        47caad8f37f26e15df2d7627313e8cb4037bdff5

                        SHA256

                        683b515da446ac70fafaed94b50706d5b808c8caada02eb0680efb97c852d123

                        SHA512

                        60ace9137c7629ff2302a8683daba35a4314b80822808de52e4d73fb2debd50b9c9e7727773270d92291382239eb615fcbf3e175f9c4375d860302a1dac97f6e

                      • memory/1572-161-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1572-145-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1572-147-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1572-149-0x0000000000400000-0x000000000055A000-memory.dmp
                      • memory/1572-144-0x0000000000000000-mapping.dmp
                      • memory/4204-139-0x0000000000000000-mapping.dmp
                      • memory/4292-130-0x0000000000490000-0x0000000000574000-memory.dmp
                      • memory/4292-135-0x000000000B590000-0x000000000B5F6000-memory.dmp
                      • memory/4292-134-0x0000000008A50000-0x0000000008AEC000-memory.dmp
                      • memory/4292-133-0x00000000050C0000-0x00000000050CA000-memory.dmp
                      • memory/4292-132-0x0000000004F00000-0x0000000004F92000-memory.dmp
                      • memory/4292-131-0x0000000005560000-0x0000000005B04000-memory.dmp
                      • memory/4584-155-0x0000000007430000-0x0000000007AAA000-memory.dmp
                      • memory/4584-157-0x0000000007070000-0x0000000007106000-memory.dmp
                      • memory/4584-141-0x0000000004A20000-0x0000000004A42000-memory.dmp
                      • memory/4584-137-0x0000000000000000-mapping.dmp
                      • memory/4584-160-0x0000000007110000-0x0000000007118000-memory.dmp
                      • memory/4584-159-0x0000000007130000-0x000000000714A000-memory.dmp
                      • memory/4584-152-0x0000000070BE0000-0x0000000070C2C000-memory.dmp
                      • memory/5104-154-0x0000000007780000-0x000000000779A000-memory.dmp
                      • memory/5104-153-0x0000000006A40000-0x0000000006A5E000-memory.dmp
                      • memory/5104-143-0x0000000005660000-0x00000000056C6000-memory.dmp
                      • memory/5104-138-0x0000000004ED0000-0x0000000004F06000-memory.dmp
                      • memory/5104-156-0x00000000077F0000-0x00000000077FA000-memory.dmp
                      • memory/5104-151-0x0000000070BE0000-0x0000000070C2C000-memory.dmp
                      • memory/5104-158-0x00000000079C0000-0x00000000079CE000-memory.dmp
                      • memory/5104-150-0x0000000006A60000-0x0000000006A92000-memory.dmp
                      • memory/5104-140-0x00000000056E0000-0x0000000005D08000-memory.dmp
                      • memory/5104-148-0x0000000006480000-0x000000000649E000-memory.dmp
                      • memory/5104-136-0x0000000000000000-mapping.dmp