Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
15-11-2022 15:59
General
-
Target
UPS Delivery Info.exe
-
Size
665KB
-
MD5
010233bc921206bf5f3cf343695520c8
-
SHA1
6e5558813b1926d2e95173f532171ab4a095d117
-
SHA256
fb98878de141d3a4a27e64c29ec0e8427e000c59e8d7018ed8e1faf3e69e4634
-
SHA512
3727f5d0eb8e326f0ab6a980c491872573c550b1059258e41f420c179895f6c3ad2017a40092285a9286b33675c50519e471a2e33d3c8a37c454b10effa32194
-
SSDEEP
12288:2B4XMgcpCYrN5HIgT+XbLFY6iWT7a/qmsFtw8674c21Rx:hICQdfT+YjWT/c8674c21b
Malware Config
Extracted
warzonerat
pastorcc.duckdns.org:2223
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
-
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 11 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\UPS Delivery Info.exe"C:\Users\Admin\AppData\Local\Temp\UPS Delivery Info.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UPS Delivery Info.exe"C:\Users\Admin\AppData\Local\Temp\UPS Delivery Info.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\UPS Delivery Info.exe"C:\Users\Admin\AppData\Local\Temp\UPS Delivery Info.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
688KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
40KB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
104KB
-
Filesize
200KB
-
Filesize
32KB
-
Filesize
104KB
-
Filesize
56KB
-
-
Filesize
216KB
-
Filesize
6.2MB
-
Filesize
136KB
-
Filesize
408KB
-
Filesize
120KB
-
Filesize
600KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
6.5MB
-
Filesize
40KB
-
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-