Analysis
- max time kernel
195s - max time network
209s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
13/10/2022, 02:51
General
- Target My ass sex.scr.exe
- Size 1.1MB
- Sample221013-db677aaebm
- SHA256 5d48967c9c428d2476403e64f9f43ec1fa2e3fe44a81c02ddd99d58b213fcde2
Malware Config
Extracted
-
warzonerat
-
37.0.14.205:8444
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 8 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\My ass sex.scr.exe"C:\Users\Admin\AppData\Local\Temp\My ass sex.scr.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\My ass sex.scr.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\My ass sex.scr.exe"C:\Users\Admin\AppData\Local\Temp\My ass sex.scr.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\My ass sex.scr.exe"C:\Users\Admin\AppData\Local\Temp\My ass sex.scr.exe"2⤵
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
memory/624-79-0x00000000733D0000-0x000000007397B000-memory.dmp
memory/624-80-0x00000000733D0000-0x000000007397B000-memory.dmp
memory/764-73-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-83-0x000000000A860000-0x000000000A960000-memory.dmp
memory/764-67-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-70-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-62-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-72-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-77-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-78-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-65-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-63-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-68-0x0000000000400000-0x000000000055A000-memory.dmp
memory/764-84-0x000000000ADF0000-0x000000000AE74000-memory.dmp
memory/1320-82-0x0000000000120000-0x0000000000121000-memory.dmp
memory/1668-54-0x00000000013C0000-0x00000000014E6000-memory.dmp
memory/1668-61-0x000000000A3C0000-0x000000000A42A000-memory.dmp
memory/1668-58-0x000000000A300000-0x000000000A3C2000-memory.dmp
memory/1668-57-0x00000000005B0000-0x00000000005BC000-memory.dmp
memory/1668-56-0x0000000000580000-0x000000000059A000-memory.dmp
memory/1668-55-0x0000000075201000-0x0000000075203000-memory.dmp