warzonerat | 30690dd57acb0fdd1b40b8985089381f463d9cc0601605782624283be72be025

General

Target

ReQUOTATION_REQUEST20200829.exe
Size

712KB
MD5

2114535592ff9c28d5bd897c10caada2
SHA1

dd06260610bc0a4dbfcb0778cd4fdf703e10770e
SHA256

30690dd57acb0fdd1b40b8985089381f463d9cc0601605782624283be72be025
SHA512

c66835bd7c66a1c957f13257718dc36b8f94af8211995cf776b4dff97e1420bf2be926de64153e4ef6f6a96e8e05fe7d39611a6eb7d6c3b6f3b7f2cc8f3f7537

Score

10^/10

rat infostealer warzonerat spyware

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3624-13-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3624-14-0x0000000000405A3D-mapping.dmp	warzonerat
behavioral2/memory/3624-15-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

ReQUOTATION_REQUEST20200829.exe

description pid process target process

PID 1496 set thread context of 3624 1496 ReQUOTATION_REQUEST20200829.exe ReQUOTATION_REQUEST20200829.exe
Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description ioc process

File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3084 schtasks.exe

description	pid	process	target process
PID 1496 set thread context of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat	svchost.exe

pid	process
3084	schtasks.exe

Modifies data under HKEY_USERS 5 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1"	svchost.exe
Set value (data)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = 1799bdf5017dd601	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

ReQUOTATION_REQUEST20200829.exe

pid process

1496 ReQUOTATION_REQUEST20200829.exe
1496 ReQUOTATION_REQUEST20200829.exe
1496 ReQUOTATION_REQUEST20200829.exe

pid	process
1496	ReQUOTATION_REQUEST20200829.exe
1496	ReQUOTATION_REQUEST20200829.exe
1496	ReQUOTATION_REQUEST20200829.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

svchost.exeReQUOTATION_REQUEST20200829.exe

description	pid	process
Token: SeShutdownPrivilege	2508	svchost.exe
Token: SeCreatePagefilePrivilege	2508	svchost.exe
Token: SeDebugPrivilege	1496	ReQUOTATION_REQUEST20200829.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

ReQUOTATION_REQUEST20200829.exe

pid process

3624 ReQUOTATION_REQUEST20200829.exe

pid	process
3624	ReQUOTATION_REQUEST20200829.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

ReQUOTATION_REQUEST20200829.exe

C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1496

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\grYggiKlrC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp31A0.tmp"
2⤵
- Creates scheduled task(s)
PID:3084

C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
2⤵
PID:3220

C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe
"C:\Users\Admin\AppData\Local\Temp\ReQUOTATION_REQUEST20200829.exe"
2⤵
- Suspicious use of SetWindowsHookEx
PID:3624

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2508

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp31A0.tmp
MD5
09153e21a4f241d9b6d94ff8fec250e2

SHA1
ebec90e5d250648d7402053c885c376ec62e6927

SHA256
084ffd05c3cacc55c8eee647f1519384e8ac6ce02eea9842eb6b12a52b113e79

SHA512
02226224bcb365ef55d9631ffd0234aa88a8ad61e67d5f7c2ba428cc1082cacb51b4761889d595336041e5a164b0117a523c622819a36403a74bfc3cce17af06

Download Submit
memory/1496-7-0x00000000055E0000-0x00000000055E1000-memory.dmp

Filesize
4KB

Download
memory/1496-9-0x0000000006970000-0x00000000069C1000-memory.dmp

Filesize
324KB

Download
memory/1496-4-0x0000000005A40000-0x0000000005A41000-memory.dmp

Filesize
4KB

Download
memory/1496-5-0x0000000005540000-0x0000000005541000-memory.dmp

Filesize
4KB

Download
memory/1496-6-0x0000000003050000-0x0000000003051000-memory.dmp

Filesize
4KB

Download
memory/1496-0-0x00000000738E0000-0x0000000073FCE000-memory.dmp

Filesize
6.9MB

Download
memory/1496-8-0x0000000005880000-0x000000000588B000-memory.dmp

Filesize
44KB

Download
memory/1496-3-0x00000000054A0000-0x00000000054A1000-memory.dmp

Filesize
4KB

Download
memory/1496-10-0x00000000069F0000-0x0000000006A1E000-memory.dmp

Filesize
184KB

Download
memory/1496-1-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Filesize
4KB

Download
memory/3084-11-0x0000000000000000-mapping.dmp

Download
memory/3624-13-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3624-14-0x0000000000405A3D-mapping.dmp

Download
memory/3624-15-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

description	pid	process	target process
PID 1496 wrote to memory of 3084	1496	ReQUOTATION_REQUEST20200829.exe	schtasks.exe
PID 1496 wrote to memory of 3084	1496	ReQUOTATION_REQUEST20200829.exe	schtasks.exe
PID 1496 wrote to memory of 3084	1496	ReQUOTATION_REQUEST20200829.exe	schtasks.exe
PID 1496 wrote to memory of 3220	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3220	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3220	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe
PID 1496 wrote to memory of 3624	1496	ReQUOTATION_REQUEST20200829.exe	ReQUOTATION_REQUEST20200829.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads