Analysis

  • max time kernel
    298s
  • max time network
    302s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21-04-2024 14:06

General

  • Target

    Server.exe

  • Size

    132KB

  • MD5

    70cac1d5f3bca89d948821f6c2b51bf7

  • SHA1

    86f8c769a840e902c0f7073943d2c0506e5c6c15

  • SHA256

    6898a4a5134e3da33a28477ce504ef8385021d2200080573e85e5ea332724d0e

  • SHA512

    e8e13f252fe72635de37c45b5a6a1a0dbed5bddcded64ad1dd5f47b94ec08a080adccf61203b20fa3922c0ac15b2d1063c6e767a4cb13154704c7f7c7f44fa69

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Server.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • NTFS ADS
    • Suspicious use of WriteProcessMemory
    PID:492
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3672
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      2⤵
        PID:4456

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzsc3p3d.030.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • memory/3672-21-0x0000000070800000-0x000000007084C000-memory.dmp

      Filesize

      304KB

    • memory/3672-5-0x0000000004E00000-0x0000000004E22000-memory.dmp

      Filesize

      136KB

    • memory/3672-31-0x00000000024C0000-0x00000000024D0000-memory.dmp

      Filesize

      64KB

    • memory/3672-4-0x0000000004EA0000-0x00000000054CA000-memory.dmp

      Filesize

      6.2MB

    • memory/3672-32-0x00000000024C0000-0x00000000024D0000-memory.dmp

      Filesize

      64KB

    • memory/3672-6-0x0000000005700000-0x0000000005766000-memory.dmp

      Filesize

      408KB

    • memory/3672-7-0x0000000005770000-0x00000000057D6000-memory.dmp

      Filesize

      408KB

    • memory/3672-1-0x0000000073E40000-0x00000000745F1000-memory.dmp

      Filesize

      7.7MB

    • memory/3672-16-0x00000000058C0000-0x0000000005C17000-memory.dmp

      Filesize

      3.3MB

    • memory/3672-17-0x0000000005CA0000-0x0000000005CBE000-memory.dmp

      Filesize

      120KB

    • memory/3672-18-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

      Filesize

      304KB

    • memory/3672-30-0x00000000062C0000-0x00000000062DE000-memory.dmp

      Filesize

      120KB

    • memory/3672-20-0x0000000006270000-0x00000000062A4000-memory.dmp

      Filesize

      208KB

    • memory/3672-0-0x00000000024D0000-0x0000000002506000-memory.dmp

      Filesize

      216KB

    • memory/3672-2-0x00000000024C0000-0x00000000024D0000-memory.dmp

      Filesize

      64KB

    • memory/3672-3-0x00000000024C0000-0x00000000024D0000-memory.dmp

      Filesize

      64KB

    • memory/3672-19-0x000000007EE90000-0x000000007EEA0000-memory.dmp

      Filesize

      64KB

    • memory/3672-33-0x0000000006CA0000-0x0000000006D44000-memory.dmp

      Filesize

      656KB

    • memory/3672-34-0x0000000007610000-0x0000000007C8A000-memory.dmp

      Filesize

      6.5MB

    • memory/3672-35-0x0000000006FD0000-0x0000000006FEA000-memory.dmp

      Filesize

      104KB

    • memory/3672-36-0x0000000007050000-0x000000000705A000-memory.dmp

      Filesize

      40KB

    • memory/3672-37-0x0000000007260000-0x00000000072F6000-memory.dmp

      Filesize

      600KB

    • memory/3672-38-0x00000000071E0000-0x00000000071F1000-memory.dmp

      Filesize

      68KB

    • memory/3672-39-0x0000000007210000-0x000000000721E000-memory.dmp

      Filesize

      56KB

    • memory/3672-40-0x0000000007220000-0x0000000007235000-memory.dmp

      Filesize

      84KB

    • memory/3672-41-0x0000000007320000-0x000000000733A000-memory.dmp

      Filesize

      104KB

    • memory/3672-45-0x0000000007310000-0x0000000007318000-memory.dmp

      Filesize

      32KB

    • memory/3672-48-0x0000000073E40000-0x00000000745F1000-memory.dmp

      Filesize

      7.7MB

    • memory/4456-49-0x0000000001380000-0x0000000001381000-memory.dmp

      Filesize

      4KB