Analysis

  • max time kernel
    293s
  • max time network
    302s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    21-04-2024 14:06

General

  • Target

    Server.exe

  • Size

    132KB

  • MD5

    70cac1d5f3bca89d948821f6c2b51bf7

  • SHA1

    86f8c769a840e902c0f7073943d2c0506e5c6c15

  • SHA256

    6898a4a5134e3da33a28477ce504ef8385021d2200080573e85e5ea332724d0e

  • SHA512

    e8e13f252fe72635de37c45b5a6a1a0dbed5bddcded64ad1dd5f47b94ec08a080adccf61203b20fa3922c0ac15b2d1063c6e767a4cb13154704c7f7c7f44fa69

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3516
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
        PID:3448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1wejxvqq.34j.ps1

      Filesize

      1B

      MD5

      c4ca4238a0b923820dcc509a6f75849b

      SHA1

      356a192b7913b04c54574d18c28d46e6395428ab

      SHA256

      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

      SHA512

      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

    • memory/3448-258-0x00000000023F0000-0x00000000023F1000-memory.dmp

      Filesize

      4KB

    • memory/3516-8-0x0000000008250000-0x00000000082B6000-memory.dmp

      Filesize

      408KB

    • memory/3516-6-0x0000000007B20000-0x0000000008148000-memory.dmp

      Filesize

      6.2MB

    • memory/3516-30-0x000000007EC70000-0x000000007EC80000-memory.dmp

      Filesize

      64KB

    • memory/3516-7-0x00000000079A0000-0x00000000079C2000-memory.dmp

      Filesize

      136KB

    • memory/3516-3-0x0000000072D70000-0x000000007345E000-memory.dmp

      Filesize

      6.9MB

    • memory/3516-9-0x0000000007A40000-0x0000000007AA6000-memory.dmp

      Filesize

      408KB

    • memory/3516-10-0x0000000008380000-0x00000000086D0000-memory.dmp

      Filesize

      3.3MB

    • memory/3516-11-0x0000000008750000-0x000000000876C000-memory.dmp

      Filesize

      112KB

    • memory/3516-31-0x0000000009B30000-0x0000000009B63000-memory.dmp

      Filesize

      204KB

    • memory/3516-13-0x0000000008AD0000-0x0000000008B46000-memory.dmp

      Filesize

      472KB

    • memory/3516-2-0x0000000004F80000-0x0000000004FB6000-memory.dmp

      Filesize

      216KB

    • memory/3516-5-0x00000000074E0000-0x00000000074F0000-memory.dmp

      Filesize

      64KB

    • memory/3516-12-0x0000000008C70000-0x0000000008CBB000-memory.dmp

      Filesize

      300KB

    • memory/3516-32-0x000000006FA70000-0x000000006FABB000-memory.dmp

      Filesize

      300KB

    • memory/3516-33-0x0000000009AF0000-0x0000000009B0E000-memory.dmp

      Filesize

      120KB

    • memory/3516-38-0x0000000009C60000-0x0000000009D05000-memory.dmp

      Filesize

      660KB

    • memory/3516-39-0x00000000074E0000-0x00000000074F0000-memory.dmp

      Filesize

      64KB

    • memory/3516-40-0x0000000009E20000-0x0000000009EB4000-memory.dmp

      Filesize

      592KB

    • memory/3516-233-0x0000000009DD0000-0x0000000009DEA000-memory.dmp

      Filesize

      104KB

    • memory/3516-238-0x0000000009DC0000-0x0000000009DC8000-memory.dmp

      Filesize

      32KB

    • memory/3516-257-0x0000000072D70000-0x000000007345E000-memory.dmp

      Filesize

      6.9MB

    • memory/3516-4-0x00000000074E0000-0x00000000074F0000-memory.dmp

      Filesize

      64KB