Analysis
-
max time kernel
148s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01-12-2022 21:00
Static task
static1
Behavioral task
behavioral1
Sample
origin.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
origin.exe
Resource
win10v2004-20220812-en
General
-
Target
origin.exe
-
Size
552KB
-
MD5
fd49a17b3d4bfe10a79a8f6c25f72f50
-
SHA1
a25885590c16d80d46846d75f1f7646bfc26c005
-
SHA256
7df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
-
SHA512
3049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
SSDEEP
12288:GPqfpmguB1C6MgG4WymunsifuHqDoCu9l9jq:IqfpmguvC6zG46u+HqDoL9j
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 10 IoCs
Processes:
resource yara_rule behavioral1/memory/1748-72-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-74-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-70-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-69-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-75-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-76-0x000000000040B556-mapping.dmp warzonerat behavioral1/memory/1748-79-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-80-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-83-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat behavioral1/memory/1748-88-0x0000000000400000-0x0000000000568000-memory.dmp warzonerat -
Executes dropped EXE 1 IoCs
Processes:
internetexploer.exepid process 1508 internetexploer.exe -
Loads dropped DLL 1 IoCs
Processes:
origin.exepid process 1748 origin.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
origin.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\internetexploer.exe = "C:\\Users\\Admin\\Documents\\internetexploer.exe" origin.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
origin.exedescription pid process target process PID 1408 set thread context of 1748 1408 origin.exe origin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
origin.exepowershell.exepid process 1408 origin.exe 1532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
origin.exepowershell.exedescription pid process Token: SeDebugPrivilege 1408 origin.exe Token: SeDebugPrivilege 1532 powershell.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
origin.exeorigin.exedescription pid process target process PID 1408 wrote to memory of 1532 1408 origin.exe powershell.exe PID 1408 wrote to memory of 1532 1408 origin.exe powershell.exe PID 1408 wrote to memory of 1532 1408 origin.exe powershell.exe PID 1408 wrote to memory of 1532 1408 origin.exe powershell.exe PID 1408 wrote to memory of 564 1408 origin.exe schtasks.exe PID 1408 wrote to memory of 564 1408 origin.exe schtasks.exe PID 1408 wrote to memory of 564 1408 origin.exe schtasks.exe PID 1408 wrote to memory of 564 1408 origin.exe schtasks.exe PID 1408 wrote to memory of 540 1408 origin.exe origin.exe PID 1408 wrote to memory of 540 1408 origin.exe origin.exe PID 1408 wrote to memory of 540 1408 origin.exe origin.exe PID 1408 wrote to memory of 540 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1408 wrote to memory of 1748 1408 origin.exe origin.exe PID 1748 wrote to memory of 1508 1748 origin.exe internetexploer.exe PID 1748 wrote to memory of 1508 1748 origin.exe internetexploer.exe PID 1748 wrote to memory of 1508 1748 origin.exe internetexploer.exe PID 1748 wrote to memory of 1508 1748 origin.exe internetexploer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\origin.exe"C:\Users\Admin\AppData\Local\Temp\origin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oyGqcapvIL.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oyGqcapvIL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp670D.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\origin.exe"C:\Users\Admin\AppData\Local\Temp\origin.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\origin.exe"C:\Users\Admin\AppData\Local\Temp\origin.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\internetexploer.exe"C:\Users\Admin\Documents\internetexploer.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp670D.tmpFilesize
1KB
MD5b7b1cd88f08bae4145103261ec50cef6
SHA174caa3ed07dfae5e9a7a5527ce4b7c206d90df15
SHA2562c9848f16f34845f454bfeaabe07f3f33a8f9eb9edcae43ad330b78cbd3a7743
SHA512284f3623a1fdfb34fbb01753559a2375617f0eb5d062bb39b77bd505a7d96912c7fed971ed9fb310f34410df1d4e88714039a868351bd950c0e09710d83adfac
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
C:\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
\Users\Admin\Documents\internetexploer.exeFilesize
552KB
MD5fd49a17b3d4bfe10a79a8f6c25f72f50
SHA1a25885590c16d80d46846d75f1f7646bfc26c005
SHA2567df4c22eb854a3167a7f606f9ad2baf1d6fff8ac85c8b4d265248e272afdbaab
SHA5123049f06b75f8ec88ffb75cdd97ac68c63f0ef4cf9d53791a6bdda0886f9021fea1b470f2b8a137ef9d4d3dac15773562878b11657f11ce041b4cfa3416d1a762
-
memory/564-60-0x0000000000000000-mapping.dmp
-
memory/1408-57-0x0000000000380000-0x000000000038E000-memory.dmpFilesize
56KB
-
memory/1408-58-0x0000000005080000-0x00000000050F0000-memory.dmpFilesize
448KB
-
memory/1408-63-0x0000000001070000-0x00000000010A6000-memory.dmpFilesize
216KB
-
memory/1408-54-0x00000000010C0000-0x000000000114A000-memory.dmpFilesize
552KB
-
memory/1408-56-0x0000000000360000-0x0000000000376000-memory.dmpFilesize
88KB
-
memory/1408-55-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1508-91-0x0000000000580000-0x0000000000596000-memory.dmpFilesize
88KB
-
memory/1508-89-0x00000000002A0000-0x000000000032A000-memory.dmpFilesize
552KB
-
memory/1508-85-0x0000000000000000-mapping.dmp
-
memory/1532-82-0x0000000073BE0000-0x000000007418B000-memory.dmpFilesize
5.7MB
-
memory/1532-81-0x0000000073BE0000-0x000000007418B000-memory.dmpFilesize
5.7MB
-
memory/1532-59-0x0000000000000000-mapping.dmp
-
memory/1748-69-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-79-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-80-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-76-0x000000000040B556-mapping.dmp
-
memory/1748-67-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-83-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-70-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-74-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-72-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-88-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-65-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-64-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB
-
memory/1748-75-0x0000000000400000-0x0000000000568000-memory.dmpFilesize
1.4MB