warzonerat | 5e74989efa96ead9311c5927e6f6a2be657a418de923461ec520d09aeaee970a

General

Target
shipping_doc.exe
Size 667KB
Sample201202-39actp67gn
SHA256 5e74989efa96ead9311c5927e6f6a2be657a418de923461ec520d09aeaee970a
MD5 260b24d2c2413006c40e6ab16834e5b0
SHA1 fec5a931a319387f9b80aa7aac7f9fa1cfa26a8a
SHA512 4f833eeee657b444edc4ab9b3e2dea46871734653c164db5dea28db52a1ca6325ce760980f294816853f57ed391c681f6791225738b23e96075205e7bf3663e5
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

eccoclean.hopto.org:7878

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/3960-14-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/3960-15-0x0000000000405738-mapping.dmp	warzonerat
behavioral2/memory/3960-16-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1316 set thread context of 3960	1316	shipping_doc.exe	84

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1320	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1316	shipping_doc.exe
1316	shipping_doc.exe
1316	shipping_doc.exe
1316	shipping_doc.exe
1316	shipping_doc.exe
1316	shipping_doc.exe
1316	shipping_doc.exe
1316	shipping_doc.exe
1316	shipping_doc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1316	shipping_doc.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1316 wrote to memory of 1320	1316	shipping_doc.exe	78
PID 1316 wrote to memory of 1320	1316	shipping_doc.exe	78
PID 1316 wrote to memory of 1320	1316	shipping_doc.exe	78
PID 1316 wrote to memory of 3828	1316	shipping_doc.exe	80
PID 1316 wrote to memory of 3828	1316	shipping_doc.exe	80
PID 1316 wrote to memory of 3828	1316	shipping_doc.exe	80
PID 1316 wrote to memory of 3944	1316	shipping_doc.exe	81
PID 1316 wrote to memory of 3944	1316	shipping_doc.exe	81
PID 1316 wrote to memory of 3944	1316	shipping_doc.exe	81
PID 1316 wrote to memory of 3272	1316	shipping_doc.exe	82
PID 1316 wrote to memory of 3272	1316	shipping_doc.exe	82
PID 1316 wrote to memory of 3272	1316	shipping_doc.exe	82
PID 1316 wrote to memory of 3976	1316	shipping_doc.exe	83
PID 1316 wrote to memory of 3976	1316	shipping_doc.exe	83
PID 1316 wrote to memory of 3976	1316	shipping_doc.exe	83
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84
PID 1316 wrote to memory of 3960	1316	shipping_doc.exe	84

C:\Users\Admin\AppData\Local\Temp\shipping_doc.exe
"C:\Users\Admin\AppData\Local\Temp\shipping_doc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VqAjhHxnu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2461.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1320
- C:\Users\Admin\AppData\Local\Temp\shipping_doc.exe
  "{path}"
  2⤵
  PID:3828
- C:\Users\Admin\AppData\Local\Temp\shipping_doc.exe
  "{path}"
  2⤵
  PID:3944
- C:\Users\Admin\AppData\Local\Temp\shipping_doc.exe
  "{path}"
  2⤵
  PID:3272
- C:\Users\Admin\AppData\Local\Temp\shipping_doc.exe
  "{path}"
  2⤵
  PID:3976
- C:\Users\Admin\AppData\Local\Temp\shipping_doc.exe
  "{path}"
  2⤵
  PID:3960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1316-9-0x0000000007150000-0x0000000007151000-memory.dmp

Download

memory/1316-5-0x0000000005BB0000-0x0000000005BB1000-memory.dmp

Download

memory/1316-6-0x00000000056B0000-0x00000000056B1000-memory.dmp

Download

memory/1316-7-0x0000000005660000-0x0000000005661000-memory.dmp

Download

memory/1316-8-0x0000000007F40000-0x0000000007F41000-memory.dmp

Download

memory/1316-2-0x0000000073C50000-0x000000007433E000-memory.dmp

Download

memory/1316-10-0x0000000007140000-0x000000000714E000-memory.dmp

Download

memory/1316-11-0x0000000007DD0000-0x0000000007E60000-memory.dmp

Download

memory/1316-3-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3960-14-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3960-16-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads