Overview

overview

10

Static

static

10

a8a83660ed...70.exe

windows7-x64

10

a8a83660ed...70.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    92s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/08/2022, 14:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    a8a83660ed3a1903b40f935a7b6b9170.exe
  • Size 113KB
  • Sample220817-rfjvcabeg2
  • SHA256 bde560e8a84bef5b1422ef285963f29f653c683f96e3b83c40e81c41fa266d2f
  • MD5 SHA1 SHA512
Score
10/10
warzoneratcollectioninfostealerpersistenceratspywarestealer

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Sets DLL path for service in the registry 2 TTPs 1 IoCs
    persistence
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
    collection
  • Modifies WinLogon 2 TTPs 4 IoCs
    persistence
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a8a83660ed3a1903b40f935a7b6b9170.exe
    "C:\Users\Admin\AppData\Local\Temp\a8a83660ed3a1903b40f935a7b6b9170.exe"
    1⤵
    • Sets DLL path for service in the registry
    • Loads dropped DLL
    • Accesses Microsoft Outlook profiles
    • Modifies WinLogon
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious use of AdjustPrivilegeToken
    • outlook_office_path
    • outlook_win_path
    PID:5088
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k NetworkService -s TermService
    1⤵
      PID:2180
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k NetworkService -s TermService
      1⤵
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3392

    Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          sqlmap.dll
          • Path C:\Program Files\Microsoft DN1\sqlmap.dll
          • Size 114KB
          • SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          freebl3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\freebl3.dll
          • Size 326KB
          • SHA256 2b00fc4f541ac10c94e3556ff28e30a801811c36422546a546a445aca3f410f7
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          mozglue.dll
          • Path C:\Users\Admin\AppData\Local\Temp\mozglue.dll
          • Size 133KB
          • SHA256 fb419a60305f17359e2ac0510233ee80e845885eee60607715c67dd88e501ef0
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          msvcp140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\msvcp140.dll
          • Size 429KB
          • SHA256 334e69ac9367f708ce601a6f490ff227d6c20636da5222f148b25831d22e13d4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          nss3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\nss3.dll
          • Size 1.2MB
          • SHA256 78758bf7f3b3b5e3477e38354acd32d787bc1286c8bd9b873471b9c195e638db
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          softokn3.dll
          • Path C:\Users\Admin\AppData\Local\Temp\softokn3.dll
          • Size 141KB
          • SHA256 bb3ff746471116c6ad0339fa0522aa2a44a787e33a29c7b27649a054ecd4d00f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          vcruntime140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\vcruntime140.dll
          • Size 81KB
          • SHA256 c40bb03199a2054dabfc7a8e01d6098e91de7193619effbd0f142a7bf031c14d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          rdpwrap.ini
          • Path \??\c:\program files\microsoft dn1\rdpwrap.ini
          • Size 247KB
          • SHA256 c59a7cf7b08fa7f79c51ca9126300b32fceece6972a9e8837d384804fd613e24
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          sqlmap.dll
          • Path \??\c:\program files\microsoft dn1\sqlmap.dll
          • Size 114KB
          • SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          memory/5088-135-0x0000000003D10000-0x0000000003D94000-memory.dmp
          Download