Analysis
-
max time kernel
107s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
05-08-2022 08:47
Static task
static1
Behavioral task
behavioral1
Sample
JOB-in.line e.K. - New Order 56899707.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
JOB-in.line e.K. - New Order 56899707.exe
Resource
win10v2004-20220721-en
General
-
Target
JOB-in.line e.K. - New Order 56899707.exe
-
Size
842KB
-
MD5
9e8d620f00f7988a79ae5c1228f37899
-
SHA1
27e5c643563bfe8dbccf7e26e9669c2cdde8e767
-
SHA256
7907827ba244123ddc19a986203a2df7f7b9e7d984ff8efe6715372e2f431062
-
SHA512
39cd5593b238c32e0644448f6e1845760ce1a56f551a97217f2ea72c7ad72725564a2b568166b84712b12b5949a0146d7c355b4756e6985311e0451f5d09f2b0
Malware Config
Extracted
warzonerat
20.91.187.223:5707
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1776-69-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1776-70-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1776-72-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1776-73-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1776-74-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1776-75-0x0000000000405CE2-mapping.dmp warzonerat behavioral1/memory/1776-78-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1776-79-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/1776-82-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
Processes:
JOB-in.line e.K. - New Order 56899707.exedescription pid process target process PID 1932 set thread context of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2044 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 2044 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
JOB-in.line e.K. - New Order 56899707.exedescription pid process target process PID 1932 wrote to memory of 2044 1932 JOB-in.line e.K. - New Order 56899707.exe powershell.exe PID 1932 wrote to memory of 2044 1932 JOB-in.line e.K. - New Order 56899707.exe powershell.exe PID 1932 wrote to memory of 2044 1932 JOB-in.line e.K. - New Order 56899707.exe powershell.exe PID 1932 wrote to memory of 2044 1932 JOB-in.line e.K. - New Order 56899707.exe powershell.exe PID 1932 wrote to memory of 1996 1932 JOB-in.line e.K. - New Order 56899707.exe schtasks.exe PID 1932 wrote to memory of 1996 1932 JOB-in.line e.K. - New Order 56899707.exe schtasks.exe PID 1932 wrote to memory of 1996 1932 JOB-in.line e.K. - New Order 56899707.exe schtasks.exe PID 1932 wrote to memory of 1996 1932 JOB-in.line e.K. - New Order 56899707.exe schtasks.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe PID 1932 wrote to memory of 1776 1932 JOB-in.line e.K. - New Order 56899707.exe JOB-in.line e.K. - New Order 56899707.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K. - New Order 56899707.exe"C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K. - New Order 56899707.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\gATZIsOK.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\gATZIsOK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp172A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K. - New Order 56899707.exe"C:\Users\Admin\AppData\Local\Temp\JOB-in.line e.K. - New Order 56899707.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp172A.tmpFilesize
1KB
MD56eb6408026f775927234e51ea79640d0
SHA1ad9dbe2851c8368084df5ce4b7c02a9e38a2178f
SHA256c2df1531979a78d8adb7488959c806b4cabdc6705f47fde23e63036750532c66
SHA512b2ccec0d2a687e61039d4190b4de0f807e8816e2ac653d469cb21e103744882e7adcbf28e5589f4d3788af1e5580c075377a3519d7028b5e278146b82946b8f3
-
memory/1776-73-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-64-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-69-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-67-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-79-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-78-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-75-0x0000000000405CE2-mapping.dmp
-
memory/1776-74-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-70-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-65-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-82-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1776-72-0x0000000000400000-0x0000000000554000-memory.dmpFilesize
1.3MB
-
memory/1932-55-0x0000000076281000-0x0000000076283000-memory.dmpFilesize
8KB
-
memory/1932-57-0x0000000000770000-0x000000000077A000-memory.dmpFilesize
40KB
-
memory/1932-54-0x0000000000C80000-0x0000000000D5A000-memory.dmpFilesize
872KB
-
memory/1932-63-0x00000000045C0000-0x00000000045E4000-memory.dmpFilesize
144KB
-
memory/1932-56-0x00000000004B0000-0x00000000004C6000-memory.dmpFilesize
88KB
-
memory/1932-58-0x000000000A430000-0x000000000A4A2000-memory.dmpFilesize
456KB
-
memory/1996-60-0x0000000000000000-mapping.dmp
-
memory/2044-59-0x0000000000000000-mapping.dmp
-
memory/2044-80-0x0000000074E60000-0x000000007540B000-memory.dmpFilesize
5.7MB
-
memory/2044-81-0x0000000074E60000-0x000000007540B000-memory.dmpFilesize
5.7MB