warzonerat | a102c4a2dfca8c218f1e65cbb5050012da856c3deba018d8c238fa9b09dd3a2b

Analysis

max time kernel
131s
max time network
142s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 20:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Invoice.pdf.exe
Size 1.6MB
Sample201109-b89p52kp52
SHA256 a102c4a2dfca8c218f1e65cbb5050012da856c3deba018d8c238fa9b09dd3a2b
MD5 928c2e9a5a0a7b0aeaae84c01e507780
SHA1 1d4602c4a30ad28faffb1c49476fa57418c8f317
SHA512 c580a0917ec7d74a83f3016bebbe9f7a170714299279818f9f18be89520b82a95e439c00c38a2fb296d25fe6a7423392adf740e99d5d77cc7a1103fef65946be
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/748-5-0x0000000000000000-mapping.dmp	servicehost

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/580-0-0x0000000001190000-0x00000000012E3000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	Invoice.pdf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	Invoice.pdf.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	Invoice.pdf.exe
File opened for modification	C:\ProgramData:ApplicationData	Invoice.pdf.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
4076	powershell.exe
4076	powershell.exe
4076	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4076	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 4076	580	Invoice.pdf.exe	79
PID 580 wrote to memory of 4076	580	Invoice.pdf.exe	79
PID 580 wrote to memory of 4076	580	Invoice.pdf.exe	79
PID 580 wrote to memory of 748	580	Invoice.pdf.exe	81
PID 580 wrote to memory of 748	580	Invoice.pdf.exe	81
PID 580 wrote to memory of 748	580	Invoice.pdf.exe	81
PID 580 wrote to memory of 748	580	Invoice.pdf.exe	81
PID 580 wrote to memory of 748	580	Invoice.pdf.exe	81

C:\Users\Admin\AppData\Local\Temp\Invoice.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Invoice.pdf.exe"
1⤵
- Drops startup file
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/580-0-0x0000000001190000-0x00000000012E3000-memory.dmp

Download

memory/748-4-0x0000000000370000-0x0000000000371000-memory.dmp

Download

memory/4076-10-0x0000000006C20000-0x0000000006C21000-memory.dmp

Download

memory/4076-13-0x0000000007C70000-0x0000000007C71000-memory.dmp

Download

memory/4076-6-0x0000000006760000-0x0000000006761000-memory.dmp

Download

memory/4076-7-0x0000000006F70000-0x0000000006F71000-memory.dmp

Download

memory/4076-8-0x0000000006B80000-0x0000000006B81000-memory.dmp

Download

memory/4076-9-0x0000000006E00000-0x0000000006E01000-memory.dmp

Download

memory/4076-11-0x00000000075A0000-0x00000000075A1000-memory.dmp

Download

memory/4076-12-0x0000000006DD0000-0x0000000006DD1000-memory.dmp

Download

memory/4076-3-0x00000000739B0000-0x000000007409E000-memory.dmp

Download

memory/4076-14-0x0000000007CC0000-0x0000000007CC1000-memory.dmp

Download

memory/4076-16-0x00000000089B0000-0x00000000089E3000-memory.dmp

Download

memory/4076-23-0x0000000008990000-0x0000000008991000-memory.dmp

Download

memory/4076-24-0x0000000008D20000-0x0000000008D21000-memory.dmp

Download

memory/4076-25-0x0000000008EC0000-0x0000000008EC1000-memory.dmp

Download

memory/4076-26-0x0000000008E70000-0x0000000008E71000-memory.dmp

Download

memory/4076-28-0x0000000008E60000-0x0000000008E61000-memory.dmp

Download