warzonerat | 4994e0b1532ec815a5c842d5bd42454c2bf4e99adc0638924545230dda11bc24

General

Target
file.rtf
Size 2KB
Sample201208-at67f6n98n
SHA256 4994e0b1532ec815a5c842d5bd42454c2bf4e99adc0638924545230dda11bc24
MD5 a32c8ab0f938fdf7f40ed96790952396
SHA1 b8454a38017418c8f3260477fcb4b6308b3a162f
SHA512 9436675877d9c9bf06342980abbb10ffab524e541b50655769b7668fe7381685a520bbfff3569ff731be033a2f5f272cd7a392cc079b808dbdffe9735a1411f1
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Npx75Eq6UJM6EOry\\pfDuguF0JGvb.exe\",explorer.exe"	Winrar.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\Npx75Eq6UJM6EOry\\QR1rwXfwXaFE.exe\" \"C:\\Users\\Admin\\AppData\\Roaming\\Npx75Eq6UJM6EOry\\pfDuguF0JGvb.exe\",explorer.exe"	images.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Blocklisted process makes network request 1 IoCs

flow	pid	Process
6	1100	EQNEDT32.EXE

Executes dropped EXE 2 IoCs

pid	Process
1064	Winrar.exe
2036	images.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	Winrar.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	Winrar.exe

Loads dropped DLL 2 IoCs

pid	Process
1100	EQNEDT32.EXE
1064	Winrar.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	Winrar.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Office loads VBA resources, possible macro or embedded object present

Launches Equation Editor 1 TTPs 1 IoCs

Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

exploit

Exploitation for Client Execution

T1203

pid	Process
1100	EQNEDT32.EXE

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	Winrar.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2024	WINWORD.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1064	Winrar.exe
Token: SeDebugPrivilege	2036	images.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2024	WINWORD.EXE
2024	WINWORD.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1100 wrote to memory of 1064	1100	EQNEDT32.EXE	32
PID 1100 wrote to memory of 1064	1100	EQNEDT32.EXE	32
PID 1100 wrote to memory of 1064	1100	EQNEDT32.EXE	32
PID 1100 wrote to memory of 1064	1100	EQNEDT32.EXE	32
PID 1064 wrote to memory of 2036	1064	Winrar.exe	35
PID 1064 wrote to memory of 2036	1064	Winrar.exe	35
PID 1064 wrote to memory of 2036	1064	Winrar.exe	35
PID 1064 wrote to memory of 2036	1064	Winrar.exe	35
PID 2036 wrote to memory of 1328	2036	images.exe	36
PID 2036 wrote to memory of 1328	2036	images.exe	36
PID 2036 wrote to memory of 1328	2036	images.exe	36
PID 2036 wrote to memory of 1328	2036	images.exe	36
PID 2036 wrote to memory of 1328	2036	images.exe	36
PID 2036 wrote to memory of 1328	2036	images.exe	36

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\file.rtf"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2024

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
1⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Launches Equation Editor
- Suspicious use of WriteProcessMemory
PID:1100
- C:\Users\Admin\AppData\Local\Temp\Winrar.exe
  "C:\Users\Admin\AppData\Local\Temp\Winrar.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  - Adds Run key to start application
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Modifies WinLogon for persistence
    - Executes dropped EXE
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2036
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:1328

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Exploitation for Client Execution

1

T1203

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1092-2-0x000007FEF6510000-0x000007FEF678A000-memory.dmp

Download

memory/1328-13-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/1328-14-0x0000000000120000-0x0000000000121000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads