Analysis
- max time kernel
137s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20240508-en - resource tags
- submitted
18/05/2024, 03:48
General
- Target 7986acff81fdbe475364a07ff01ad325.exe
- Size 132KB
- Sample240518-ecrpkaaf21
- SHA256 f9ce9a047b096cb954193ac49049ccb28a476aa8c202f09aea38eae3cb283387
Malware Config
Signatures
- WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Drops startup file 2 IoCs
- NTFS ADS 2 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7986acff81fdbe475364a07ff01ad325.exe"C:\Users\Admin\AppData\Local\Temp\7986acff81fdbe475364a07ff01ad325.exe"1⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_rr2yw34c.mzc.ps1
memory/2068-48-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/5024-32-0x00000000070A0000-0x00000000070BE000-memory.dmp
memory/5024-45-0x0000000007440000-0x0000000007454000-memory.dmp
memory/5024-4-0x0000000073C50000-0x0000000074400000-memory.dmp
memory/5024-5-0x0000000005770000-0x0000000005792000-memory.dmp
memory/5024-21-0x00000000704D0000-0x000000007051C000-memory.dmp
memory/5024-7-0x0000000005880000-0x00000000058E6000-memory.dmp
memory/5024-2-0x0000000073C50000-0x0000000074400000-memory.dmp
memory/5024-17-0x00000000058F0000-0x0000000005C44000-memory.dmp
memory/5024-18-0x0000000005ED0000-0x0000000005EEE000-memory.dmp
memory/5024-19-0x0000000006450000-0x000000000649C000-memory.dmp
memory/5024-20-0x00000000064A0000-0x00000000064D2000-memory.dmp
memory/5024-31-0x0000000073C50000-0x0000000074400000-memory.dmp
memory/5024-3-0x0000000005110000-0x0000000005738000-memory.dmp
memory/5024-0-0x0000000073C5E000-0x0000000073C5F000-memory.dmp
memory/5024-6-0x0000000005810000-0x0000000005876000-memory.dmp
memory/5024-34-0x0000000073C50000-0x0000000074400000-memory.dmp
memory/5024-35-0x0000000073C50000-0x0000000074400000-memory.dmp
memory/5024-36-0x0000000007840000-0x0000000007EBA000-memory.dmp
memory/5024-37-0x0000000007200000-0x000000000721A000-memory.dmp
memory/5024-41-0x0000000007270000-0x000000000727A000-memory.dmp
memory/5024-42-0x0000000007480000-0x0000000007516000-memory.dmp
memory/5024-43-0x0000000007400000-0x0000000007411000-memory.dmp
memory/5024-44-0x0000000007430000-0x000000000743E000-memory.dmp
memory/5024-33-0x00000000070C0000-0x0000000007163000-memory.dmp
memory/5024-46-0x0000000007540000-0x000000000755A000-memory.dmp
memory/5024-47-0x0000000007520000-0x0000000007528000-memory.dmp
memory/5024-1-0x00000000025B0000-0x00000000025E6000-memory.dmp
memory/5024-52-0x0000000073C50000-0x0000000074400000-memory.dmp