Analysis
- max time kernel
96s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
14/10/2022, 03:59
General
- Target 58aa1601977688bea87b137d8fff8757.exe
- Size 1.2MB
- Sample221014-ej24wafdg9
- SHA256 b878058400111ad01eb49ef0d08404c23f42bf2f6a81bdc2f152bef1fd16462e
Malware Config
Extracted
-
warzonerat
-
192.3.111.154:5200
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 3 IoCs
- Executes dropped EXE 1 IoCs
- Sets DLL path for service in the registry 2 TTPs 1 IoCs
- Drops startup file 2 IoCs
- Loads dropped DLL 7 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies WinLogon 2 TTPs 4 IoCs
- Drops file in System32 directory 1 IoCs
- Drops file in Program Files directory 2 IoCs
- NTFS ADS 1 IoCs
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\58aa1601977688bea87b137d8fff8757.exe"C:\Users\Admin\AppData\Local\Temp\58aa1601977688bea87b137d8fff8757.exe"1⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\ProgramData\itunes.exe"C:\ProgramData\itunes.exe"2⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -s TermService1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
sqlmap.dll
itunes.exe
itunes.exe
powershell.exe.log
StartupProfileData-NonInteractive
freebl3.dll
mozglue.dll
msvcp140.dll
nss3.dll
softokn3.dll
vcruntime140.dll
rdpwrap.ini
sqlmap.dll
memory/1580-160-0x0000000000790000-0x0000000000791000-memory.dmp
memory/2276-182-0x0000000004880000-0x0000000004904000-memory.dmp
memory/2276-149-0x0000000002B90000-0x0000000002CE4000-memory.dmp
memory/2276-183-0x0000000004880000-0x0000000004904000-memory.dmp
memory/2276-172-0x0000000004F80000-0x0000000005004000-memory.dmp
memory/2276-166-0x00000000046D0000-0x0000000004870000-memory.dmp
memory/2420-164-0x00000000743A0000-0x00000000743EC000-memory.dmp
memory/2420-167-0x0000000007680000-0x000000000768E000-memory.dmp
memory/2420-168-0x0000000007790000-0x00000000077AA000-memory.dmp
memory/3184-132-0x0000000002480000-0x0000000002E80000-memory.dmp
memory/3184-133-0x00000000022E0000-0x0000000002434000-memory.dmp
memory/4356-147-0x0000000006150000-0x00000000061B6000-memory.dmp
memory/4356-169-0x0000000007E10000-0x0000000007E18000-memory.dmp
memory/4356-165-0x0000000007D70000-0x0000000007E06000-memory.dmp
memory/4356-163-0x0000000007B60000-0x0000000007B6A000-memory.dmp
memory/4356-162-0x0000000007AF0000-0x0000000007B0A000-memory.dmp
memory/4356-161-0x0000000008140000-0x00000000087BA000-memory.dmp
memory/4356-157-0x0000000006D90000-0x0000000006DAE000-memory.dmp
memory/4356-156-0x00000000743A0000-0x00000000743EC000-memory.dmp
memory/4356-155-0x0000000007790000-0x00000000077C2000-memory.dmp
memory/4356-148-0x00000000067E0000-0x00000000067FE000-memory.dmp
memory/4356-146-0x00000000060E0000-0x0000000006146000-memory.dmp
memory/4356-145-0x0000000006040000-0x0000000006062000-memory.dmp
memory/4356-144-0x00000000059D0000-0x0000000005FF8000-memory.dmp
memory/4356-143-0x0000000002EC0000-0x0000000002EF6000-memory.dmp