warzonerat | 9644b2e969c1f31621ec532efcdea76079eb9d9e64d20878fc69ec79fbc10ed4

General

Target
RFQ New Order Quote.exe
Size 1.5MB
Sample201019-lx4vt759sn
SHA256 9644b2e969c1f31621ec532efcdea76079eb9d9e64d20878fc69ec79fbc10ed4
MD5 0f0e97befc3e0df47c38008e0e513213
SHA1 047fca63185782e3b20a4c2a731696d8c1f890ec
SHA512 fd29cb691e93a08607a23208311d4a287f81adf41c3f5d42d9f3673cb92f51024089e4aad1795a4ab244d8b894230b144341d5911f17e3a7cb0e4541f251c283
MD5 SHA1 SHA512

Score

10^/10

rat infostealer warzonerat persistence spyware

Malware Config

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1956 created 644	1956	WerFault.exe	73

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/644-3-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/644-4-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/644-5-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2056-14-0x0000000000405CE2-mapping.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
1412	notepad.exe
2056	notepad.exe

Loads dropped DLL 6 IoCs

pid	Process
2056	notepad.exe
2056	notepad.exe
2056	notepad.exe
2056	notepad.exe
2056	notepad.exe
2056	notepad.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Explorer = "C:\\ProgramData\\notepad.exe"	RFQ New Order Quote.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral2/files/0x000100000001adbf-23.dat	js

Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs

pid	Process
3676	RFQ New Order Quote.exe
1412	notepad.exe
1412	notepad.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3676 set thread context of 644	3676	RFQ New Order Quote.exe	73
PID 1412 set thread context of 2056	1412	notepad.exe	79

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1956	644	WerFault.exe	73

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3676	RFQ New Order Quote.exe
3676	RFQ New Order Quote.exe
1412	notepad.exe
1412	notepad.exe

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
3676	RFQ New Order Quote.exe
1412	notepad.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
3676	RFQ New Order Quote.exe
1412	notepad.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 644	3676	RFQ New Order Quote.exe	73
PID 3676 wrote to memory of 644	3676	RFQ New Order Quote.exe	73
PID 3676 wrote to memory of 644	3676	RFQ New Order Quote.exe	73
PID 644 wrote to memory of 1412	644	RFQ New Order Quote.exe	76
PID 644 wrote to memory of 1412	644	RFQ New Order Quote.exe	76
PID 644 wrote to memory of 1412	644	RFQ New Order Quote.exe	76
PID 1412 wrote to memory of 2056	1412	notepad.exe	79
PID 1412 wrote to memory of 2056	1412	notepad.exe	79
PID 1412 wrote to memory of 2056	1412	notepad.exe	79
PID 2056 wrote to memory of 2420	2056	notepad.exe	80
PID 2056 wrote to memory of 2420	2056	notepad.exe	80
PID 2056 wrote to memory of 2420	2056	notepad.exe	80
PID 2056 wrote to memory of 2420	2056	notepad.exe	80
PID 2056 wrote to memory of 2420	2056	notepad.exe	80

C:\Users\Admin\AppData\Local\Temp\RFQ New Order Quote.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ New Order Quote.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Users\Admin\AppData\Local\Temp\RFQ New Order Quote.exe
  "C:\Users\Admin\AppData\Local\Temp\RFQ New Order Quote.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\ProgramData\notepad.exe
    "C:\ProgramData\notepad.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1412
  - - C:\ProgramData\notepad.exe
      "C:\ProgramData\notepad.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:2056
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:2420
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 644 -s 828
    3⤵
    - Suspicious use of NtCreateProcessExOtherParentProcess
    - Program crash
    PID:1956

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/644-3-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/644-5-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1412-11-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/1412-10-0x00000000032B0000-0x00000000032B1000-memory.dmp

Download

memory/1412-9-0x00000000030B0000-0x00000000030B1000-memory.dmp

Download

memory/1956-13-0x0000000004530000-0x0000000004531000-memory.dmp

Download

memory/2420-18-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/3676-0-0x0000000003770000-0x0000000003771000-memory.dmp

Download

memory/3676-2-0x0000000000400000-0x000000000084E000-memory.dmp

Download

memory/3676-1-0x0000000003970000-0x0000000003971000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads