Analysis
- max time kernel
181s - max time network
192s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
12/10/2022, 15:58
General
- Target 2fe805ea35809253e8b4d7156053cea183e875897006f8f2739e785ff1944dfc.exe
- Size 634KB
- Sample221012-te1sksadg2
- SHA256 2fe805ea35809253e8b4d7156053cea183e875897006f8f2739e785ff1944dfc
Malware Config
Extracted
-
warzonerat
-
76.8.53.133:1198
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 22 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2fe805ea35809253e8b4d7156053cea183e875897006f8f2739e785ff1944dfc.exe"C:\Users\Admin\AppData\Local\Temp\2fe805ea35809253e8b4d7156053cea183e875897006f8f2739e785ff1944dfc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BRRuDCGs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BRRuDCGs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp652D.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\2fe805ea35809253e8b4d7156053cea183e875897006f8f2739e785ff1944dfc.exe"C:\Users\Admin\AppData\Local\Temp\2fe805ea35809253e8b4d7156053cea183e875897006f8f2739e785ff1944dfc.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
tmp652D.tmp
memory/920-154-0x0000000006120000-0x000000000613E000-memory.dmp
memory/920-153-0x0000000070D60000-0x0000000070DAC000-memory.dmp
memory/920-161-0x0000000007190000-0x0000000007198000-memory.dmp
memory/920-160-0x00000000071B0000-0x00000000071CA000-memory.dmp
memory/920-147-0x0000000005340000-0x00000000053A6000-memory.dmp
memory/920-159-0x00000000070A0000-0x00000000070AE000-memory.dmp
memory/920-139-0x00000000045C0000-0x00000000045F6000-memory.dmp
memory/920-158-0x00000000070F0000-0x0000000007186000-memory.dmp
memory/920-141-0x0000000004C30000-0x0000000005258000-memory.dmp
memory/920-156-0x0000000006E70000-0x0000000006E8A000-memory.dmp
memory/920-155-0x00000000074C0000-0x0000000007B3A000-memory.dmp
memory/920-145-0x0000000004B90000-0x0000000004BB2000-memory.dmp
memory/920-146-0x0000000005260000-0x00000000052C6000-memory.dmp
memory/920-157-0x0000000006EE0000-0x0000000006EEA000-memory.dmp
memory/920-152-0x0000000006140000-0x0000000006172000-memory.dmp
memory/920-150-0x0000000005B70000-0x0000000005B8E000-memory.dmp
memory/2040-134-0x0000000004B20000-0x0000000004BB2000-memory.dmp
memory/2040-132-0x0000000000160000-0x0000000000204000-memory.dmp
memory/2040-133-0x00000000050D0000-0x0000000005674000-memory.dmp
memory/2040-136-0x0000000008810000-0x00000000088AC000-memory.dmp
memory/2040-135-0x0000000004A70000-0x0000000004A7A000-memory.dmp
memory/4224-151-0x0000000000400000-0x000000000055A000-memory.dmp
memory/4224-149-0x0000000000400000-0x000000000055A000-memory.dmp
memory/4224-143-0x0000000000400000-0x000000000055A000-memory.dmp
memory/4224-148-0x0000000000400000-0x000000000055A000-memory.dmp