warzonerat | a25edd5d4e3df428ac1c9cef50bb5508070a3202ec645a65b40781b9fb4e54d9

General

Target
Order #DCF 465789.exe
Size 977KB
Sample201119-kre41dclpe
SHA256 a25edd5d4e3df428ac1c9cef50bb5508070a3202ec645a65b40781b9fb4e54d9
MD5 31af86a1993ff792560cfe5089433a3d
SHA1 4069da772eb643ab6ae15e811fe1bd058adb0761
SHA512 89cea2a7f2a71ff9256eafffb4016c3c49dcb1fe55038074194f3280a831375bdc25e94db6fd923b23358b9003fd620fecaf3f04aaa9e5d1df1fe5f71dc9f0a5
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat spyware

Malware Config

Extracted

Family

warzonerat

C2

67.205.143.54:5555

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/724-12-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/724-13-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/724-14-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Loads dropped DLL 7 IoCs

pid	Process
1592	svchost.exe
724	Order #DCF 465789.exe
724	Order #DCF 465789.exe
724	Order #DCF 465789.exe
724	Order #DCF 465789.exe
724	Order #DCF 465789.exe
724	Order #DCF 465789.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	Order #DCF 465789.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	Order #DCF 465789.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\qHBFnfd = "0"	Order #DCF 465789.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	Order #DCF 465789.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\rfxvmt.dll	Order #DCF 465789.exe
File created	C:\Windows\System32\rfxvmt.dll	Order #DCF 465789.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 724	4800	Order #DCF 465789.exe	80

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	Order #DCF 465789.exe
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	Order #DCF 465789.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
540	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1592	svchost.exe
1592	svchost.exe
1592	svchost.exe
1592	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
656	Process not Found

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	724	Order #DCF 465789.exe
Token: SeAuditPrivilege	1592	svchost.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 540	4800	Order #DCF 465789.exe	78
PID 4800 wrote to memory of 540	4800	Order #DCF 465789.exe	78
PID 4800 wrote to memory of 540	4800	Order #DCF 465789.exe	78
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80
PID 4800 wrote to memory of 724	4800	Order #DCF 465789.exe	80

C:\Users\Admin\AppData\Local\Temp\Order #DCF 465789.exe
"C:\Users\Admin\AppData\Local\Temp\Order #DCF 465789.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kLBqgrDtzZnPs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp12BE.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:540
- C:\Users\Admin\AppData\Local\Temp\Order #DCF 465789.exe
  "{path}"
  2⤵
  - Loads dropped DLL
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  PID:724

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s TermService
1⤵
PID:1428

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1592