warzonerat | 0ca6d24907152bf5a6dd6a35cf7ab3e7712ebfa0a2245f2bdfc8a17ebed71bc4

Analysis

max time kernel
137s
max time network
150s
platform
windows7_x64
resource
win7v20201028
submitted
09/11/2020, 19:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Factura_de_Cobro.exe
Size 764KB
Sample201109-4byhdkseen
SHA256 0ca6d24907152bf5a6dd6a35cf7ab3e7712ebfa0a2245f2bdfc8a17ebed71bc4
MD5 b83ebbc2f4eabb1e74fcd32716a63e7a
SHA1 350b7e08b334eebf01029ff0faa08ce11690d6b2
SHA512 c65079d90858c8beb33da7a7e8741fd1a3024d394ec5576a9bd0455600c17317e3f7d4cf52159111523240b41cebd9c00fee784ca2289570746560e1f1dfba36
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1756-0-0x0000000000BA0000-0x0000000000CF3000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	Factura_de_Cobro.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	Factura_de_Cobro.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	Factura_de_Cobro.exe
File opened for modification	C:\ProgramData:ApplicationData	Factura_de_Cobro.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1524	powershell.exe
1524	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1524	powershell.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 1756 wrote to memory of 1524	1756	Factura_de_Cobro.exe	30
PID 1756 wrote to memory of 1524	1756	Factura_de_Cobro.exe	30
PID 1756 wrote to memory of 1524	1756	Factura_de_Cobro.exe	30
PID 1756 wrote to memory of 1524	1756	Factura_de_Cobro.exe	30
PID 1756 wrote to memory of 1244	1756	Factura_de_Cobro.exe	32
PID 1756 wrote to memory of 1244	1756	Factura_de_Cobro.exe	32
PID 1756 wrote to memory of 1244	1756	Factura_de_Cobro.exe	32
PID 1756 wrote to memory of 1244	1756	Factura_de_Cobro.exe	32
PID 1756 wrote to memory of 1244	1756	Factura_de_Cobro.exe	32
PID 1756 wrote to memory of 1244	1756	Factura_de_Cobro.exe	32

C:\Users\Admin\AppData\Local\Temp\Factura_de_Cobro.exe
"C:\Users\Admin\AppData\Local\Temp\Factura_de_Cobro.exe"
1⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1756
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1524
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1244

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-6-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1244-7-0x0000000000160000-0x0000000000161000-memory.dmp

Download

memory/1524-4-0x0000000073CC0000-0x00000000743AE000-memory.dmp

Download

memory/1524-14-0x0000000006020000-0x0000000006021000-memory.dmp

Download

memory/1524-43-0x0000000006310000-0x0000000006311000-memory.dmp

Download

memory/1524-9-0x0000000004710000-0x0000000004711000-memory.dmp

Download

memory/1524-10-0x0000000004600000-0x0000000004601000-memory.dmp

Download

memory/1524-11-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/1524-5-0x00000000023C0000-0x00000000023C1000-memory.dmp

Download

memory/1524-19-0x00000000060E0000-0x00000000060E1000-memory.dmp

Download

memory/1524-20-0x0000000006120000-0x0000000006121000-memory.dmp

Download

memory/1524-27-0x0000000006280000-0x0000000006281000-memory.dmp

Download

memory/1524-28-0x0000000005FE0000-0x0000000005FE1000-memory.dmp

Download

memory/1524-42-0x0000000006300000-0x0000000006301000-memory.dmp

Download

memory/1756-0-0x0000000000BA0000-0x0000000000CF3000-memory.dmp

Download