Analysis
- max time kernel
132s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
22/08/2022, 06:32
General
- Target SecuriteInfo.com.W32.AIDetectNet.01.1480.exe
- Size 860KB
- Sample220822-hal8vaehb4
- SHA256 49d62dd6da73771894fbb042c49c3f487f0f8388aab64db42c8ab132df10c234
Malware Config
Extracted
-
warzonerat
-
91.192.100.8:4441
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1480.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1480.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1480.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1480.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetectNet.01.1480.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2288-151-0x0000000006DA0000-0x0000000006DBE000-memory.dmp
memory/2288-152-0x0000000008150000-0x00000000087CA000-memory.dmp
memory/2288-158-0x0000000007E20000-0x0000000007E28000-memory.dmp
memory/2288-156-0x0000000007D30000-0x0000000007D3E000-memory.dmp
memory/2288-155-0x0000000007D80000-0x0000000007E16000-memory.dmp
memory/2288-154-0x0000000007B70000-0x0000000007B7A000-memory.dmp
memory/2288-153-0x0000000007B00000-0x0000000007B1A000-memory.dmp
memory/2288-141-0x0000000005240000-0x0000000005276000-memory.dmp
memory/2288-145-0x0000000006120000-0x0000000006186000-memory.dmp
memory/2288-143-0x0000000005920000-0x0000000005F48000-memory.dmp
memory/2288-147-0x0000000006190000-0x00000000061F6000-memory.dmp
memory/2288-150-0x0000000070610000-0x000000007065C000-memory.dmp
memory/2288-157-0x0000000007E40000-0x0000000007E5A000-memory.dmp
memory/2288-144-0x0000000006080000-0x00000000060A2000-memory.dmp
memory/2288-148-0x0000000006800000-0x000000000681E000-memory.dmp
memory/2288-149-0x0000000006DC0000-0x0000000006DF2000-memory.dmp
memory/3020-142-0x0000000000400000-0x000000000055A000-memory.dmp
memory/3020-139-0x0000000000400000-0x000000000055A000-memory.dmp
memory/3020-146-0x0000000000400000-0x000000000055A000-memory.dmp
memory/3020-159-0x0000000000400000-0x000000000055A000-memory.dmp
memory/5016-133-0x0000000005660000-0x0000000005C04000-memory.dmp
memory/5016-132-0x0000000000820000-0x00000000008FC000-memory.dmp
memory/5016-136-0x00000000077C0000-0x000000000785C000-memory.dmp
memory/5016-135-0x00000000052F0000-0x00000000052FA000-memory.dmp
memory/5016-134-0x0000000005150000-0x00000000051E2000-memory.dmp