Analysis
-
max time kernel
135s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2022, 16:49
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220812-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220812-en
6 signatures
150 seconds
General
-
Target
tmp.exe
-
Size
132KB
-
MD5
81e7f2e0b5e3b75526bf74575f4201a7
-
SHA1
54a08f5781f83b0f58776222cb8299f865a69bae
-
SHA256
a9602ca7dcde481b43334f5a5eaa9dda63b645486f79cd022ac40f187a2a1821
-
SHA512
b799d2932ba653b87439a8848ba76d800442d4a80cbeff85435a965d1c5180b34581b326cfb9142dd96de115944c87e130e4e8416f1405a32767688c55005f1e
-
SSDEEP
3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
Score
10/10
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat tmp.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start tmp.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\Documents\Documents:ApplicationData tmp.exe File opened for modification C:\Users\Admin\Documents\Documents:ApplicationData tmp.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2224 powershell.exe 2224 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2224 powershell.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4232 wrote to memory of 2224 4232 tmp.exe 76 PID 4232 wrote to memory of 2224 4232 tmp.exe 76 PID 4232 wrote to memory of 2224 4232 tmp.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-