warzonerat | 661f94e6edb8ac51fd9b7831a45102586aec2fb596ca799c709b806784ff0785

General

Target
SecuriteInfo.com.ArtemisE75CF5623616.17038.exe
Size 164KB
Sample201014-7jk648tps2
SHA256 661f94e6edb8ac51fd9b7831a45102586aec2fb596ca799c709b806784ff0785
MD5 e75cf56236168f6d98425f13658737b6
SHA1 0ce6559d857175bcc007cdda6c3fca2c7d7dc6ba
SHA512 2d1368464dd1161ea9a505e41d87e8a9d9b6ce83d9591dc2f8896c490a721e5291c139240249b1a9fcfef62ecf398069fe830f3cc47008f097fa907be16ced19
MD5 SHA1 SHA512

Score

10^/10

rat infostealer warzonerat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/2964-5-0x0000000000000000-mapping.dmp	servicehost

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe
2056	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe
2056	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3952 set thread context of 2056	3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	75

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b06010505070308060a2b0601040182370a030406082b0601050507030606082b0601050507030106082b0601050507030706082b0601050507030206082b0601050507030406082b0601050507030353000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 2056	3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	75
PID 3952 wrote to memory of 2056	3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	75
PID 3952 wrote to memory of 2056	3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	75
PID 3952 wrote to memory of 2056	3952	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	75
PID 2056 wrote to memory of 2964	2056	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	76
PID 2056 wrote to memory of 2964	2056	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	76
PID 2056 wrote to memory of 2964	2056	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	76
PID 2056 wrote to memory of 2964	2056	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	76
PID 2056 wrote to memory of 2964	2056	SecuriteInfo.com.ArtemisE75CF5623616.17038.exe	76

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisE75CF5623616.17038.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisE75CF5623616.17038.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisE75CF5623616.17038.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.ArtemisE75CF5623616.17038.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Modifies system certificate store
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

Analysis

Sharing