Analysis
- max time kernel
77s - max time network
118s - platform
windows7_x64 - resource
win7-20220901-en - resource tags
- submitted
03/11/2022, 12:35
General
- Target PAY_C25822110211180_pdf.exe
- Size 785KB
- Sample221103-psc68aabh2
- SHA256 2bfbbbf3105253503802f18a048d3b36954efeb97ecb9ab9556dffa98bfb832a
Malware Config
Extracted
-
warzonerat
-
wazminister.duckdns.org:5200
Signatures
- ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- ModiLoader Second Stage 29 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Modifies system certificate store 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAY_C25822110211180_pdf.exe"C:\Users\Admin\AppData\Local\Temp\PAY_C25822110211180_pdf.exe"1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\colorcpl.exeC:\Windows\System32\colorcpl.exe2⤵
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1280-74-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-82-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-57-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-58-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-60-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-81-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-61-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-68-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-64-0x0000000010670000-0x00000000107D0000-memory.dmp
memory/1280-69-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-65-0x0000000010670000-0x00000000107D0000-memory.dmp
memory/1280-90-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-89-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-88-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-87-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-86-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-85-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-84-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-55-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-83-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-59-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-80-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-79-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-78-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-77-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-76-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-75-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-54-0x0000000075601000-0x0000000075603000-memory.dmp
memory/1280-72-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-73-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-71-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1280-70-0x0000000000290000-0x00000000002BB000-memory.dmp
memory/1440-66-0x0000000010670000-0x00000000107D0000-memory.dmp
memory/1440-91-0x0000000010670000-0x00000000107D0000-memory.dmp
memory/1440-92-0x0000000002E00000-0x0000000002F5E000-memory.dmp
memory/1440-93-0x0000000002E00000-0x0000000002F5E000-memory.dmp