Analysis
- max time kernel
153s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
29/10/2022, 18:11
General
- Target 06e43f3481a5ad12afd6e8e92a41c0d0.exe
- Size 200KB
- Sample221029-wsla6aaadl
- SHA256 05d2253645c1f9b2b8cdc1bf7dff177a68ad41f35ef21fbb835aa45c210a6d41
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Warzone RAT payload 4 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06e43f3481a5ad12afd6e8e92a41c0d0.exe"C:\Users\Admin\AppData\Local\Temp\06e43f3481a5ad12afd6e8e92a41c0d0.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2544-134-0x0000000000400000-0x0000000000568000-memory.dmp
memory/2544-136-0x0000000000400000-0x0000000000568000-memory.dmp
memory/2544-138-0x0000000000400000-0x0000000000568000-memory.dmp
memory/2544-139-0x0000000000400000-0x0000000000568000-memory.dmp
memory/3884-132-0x0000000075270000-0x0000000075821000-memory.dmp
memory/3884-137-0x0000000075270000-0x0000000075821000-memory.dmp