Analysis
- max time kernel
130s - max time network
174s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
14/10/2022, 02:18
General
- Target 62d858df93a1ef71f5ed7ed1d8111395.exe
- Size 2.5MB
- Sample221014-cq92yscde4
- SHA256 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056
Malware Config
Extracted
-
warzonerat
-
192.3.111.154:5200
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Sets DLL path for service in the registry 2 TTPs 1 IoCs
- Drops startup file 2 IoCs
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies WinLogon 2 TTPs 4 IoCs
- Drops file in System32 directory 1 IoCs
- Drops file in Program Files directory 2 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\62d858df93a1ef71f5ed7ed1d8111395.exe"C:\Users\Admin\AppData\Local\Temp\62d858df93a1ef71f5ed7ed1d8111395.exe"1⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\itunes.exe"C:\ProgramData\itunes.exe"2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
sqlmap.dll
itunes.exe
itunes.exe
powershell.exe.log
StartupProfileData-NonInteractive
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
rdpwrap.ini
sqlmap.dll
memory/1100-147-0x0000000005D20000-0x0000000005D86000-memory.dmp
memory/1100-149-0x00000000069C0000-0x00000000069F2000-memory.dmp
memory/1100-152-0x0000000007D10000-0x000000000838A000-memory.dmp
memory/1100-153-0x00000000076D0000-0x00000000076EA000-memory.dmp
memory/1100-154-0x0000000007740000-0x000000000774A000-memory.dmp
memory/1100-155-0x0000000007950000-0x00000000079E6000-memory.dmp
memory/1100-156-0x0000000007900000-0x000000000790E000-memory.dmp
memory/1100-157-0x0000000007A10000-0x0000000007A2A000-memory.dmp
memory/1100-158-0x00000000079F0000-0x00000000079F8000-memory.dmp
memory/1100-143-0x0000000002A20000-0x0000000002A56000-memory.dmp
memory/1100-144-0x0000000005580000-0x0000000005BA8000-memory.dmp
memory/1100-150-0x00000000707E0000-0x000000007082C000-memory.dmp
memory/1100-151-0x0000000006980000-0x000000000699E000-memory.dmp
memory/1100-145-0x00000000053B0000-0x00000000053D2000-memory.dmp
memory/1100-146-0x0000000005510000-0x0000000005576000-memory.dmp
memory/1100-148-0x00000000063D0000-0x00000000063EE000-memory.dmp
memory/1484-169-0x0000000000C60000-0x0000000000C61000-memory.dmp
memory/2424-171-0x0000000004E40000-0x0000000004FE0000-memory.dmp
memory/2424-175-0x0000000005080000-0x0000000005104000-memory.dmp
memory/2424-159-0x0000000003730000-0x0000000003884000-memory.dmp
memory/2424-182-0x0000000005080000-0x0000000005104000-memory.dmp
memory/3964-170-0x00000000706C0000-0x000000007070C000-memory.dmp
memory/5032-132-0x0000000003BE0000-0x0000000003D34000-memory.dmp
memory/5032-138-0x00000000031E0000-0x0000000003BE0000-memory.dmp