warzonerat | 424f9c5a1a18e8761ab0e7c549bd7a8d9d5c5824dcb4c812d8f3fa6cd5ed756e

Analysis

max time kernel
109s
max time network
113s
platform
windows10_x64
resource
win10v20201028
submitted
22/12/2020, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RPG-06708.exe
Size 907KB
Sample201222-rjfl7d4kln
SHA256 424f9c5a1a18e8761ab0e7c549bd7a8d9d5c5824dcb4c812d8f3fa6cd5ed756e
MD5 c5489dc2d64ae3ec8abcce20e4159eda
SHA1 b34cbcfeac6e2cfa83f81eb4ab9406bf3b598447
SHA512 a37ac08052f21590f446269494524316a584f14c838164e6d68036b786b6ca248914cc63f2ec0445aace33a23892a1b32173dda98f0fa0b55f9997bf5e9ef043
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

port15e.zapto.org:1313

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2292 created 1308	2292	WerFault.exe	86

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/1308-566-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1308-567-0x0000000000700000-0x0000000000854000-memory.dmp	warzonerat
behavioral2/memory/1308-570-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1308-569-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1308-571-0x0000000000405CE2-mapping.dmp	warzonerat

Executes dropped EXE 1 IoCs

pid	Process
2032	myhsr.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\reriy = "C:\\Users\\Admin\\myhsr.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2032 set thread context of 1308	2032	myhsr.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2292	1308	WerFault.exe	86

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
2604	RPG-06708.exe
2032	myhsr.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe
2292	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2604	RPG-06708.exe
Token: SeDebugPrivilege	2032	myhsr.exe
Token: SeRestorePrivilege	2292	WerFault.exe
Token: SeBackupPrivilege	2292	WerFault.exe
Token: SeDebugPrivilege	2292	WerFault.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 2740	2604	RPG-06708.exe	78
PID 2604 wrote to memory of 2740	2604	RPG-06708.exe	78
PID 2604 wrote to memory of 2740	2604	RPG-06708.exe	78
PID 2604 wrote to memory of 184	2604	RPG-06708.exe	80
PID 2604 wrote to memory of 184	2604	RPG-06708.exe	80
PID 2604 wrote to memory of 184	2604	RPG-06708.exe	80
PID 184 wrote to memory of 2032	184	cmd.exe	82
PID 184 wrote to memory of 2032	184	cmd.exe	82
PID 184 wrote to memory of 2032	184	cmd.exe	82
PID 2032 wrote to memory of 1824	2032	myhsr.exe	83
PID 2032 wrote to memory of 1824	2032	myhsr.exe	83
PID 2032 wrote to memory of 1824	2032	myhsr.exe	83
PID 1824 wrote to memory of 3124	1824	cmd.exe	85
PID 1824 wrote to memory of 3124	1824	cmd.exe	85
PID 1824 wrote to memory of 3124	1824	cmd.exe	85
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86
PID 2032 wrote to memory of 1308	2032	myhsr.exe	86

C:\Users\Admin\AppData\Local\Temp\RPG-06708.exe
"C:\Users\Admin\AppData\Local\Temp\RPG-06708.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\RPG-06708.exe" "C:\Users\Admin\myhsr.exe"
  2⤵
  PID:2740
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\myhsr.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:184
- - C:\Users\Admin\myhsr.exe
    "C:\Users\Admin\myhsr.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "reriy" /t REG_SZ /d "C:\Users\Admin\myhsr.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1824
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "reriy" /t REG_SZ /d "C:\Users\Admin\myhsr.exe"
        5⤵
        Adds Run key to start application
        
        PID:3124
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:1308
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1308 -s 196
        5⤵
        Suspicious use of NtCreateProcessExOtherParentProcess
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2292

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1308-567-0x0000000000700000-0x0000000000854000-memory.dmp

Download

memory/2032-563-0x0000000009580000-0x000000000958A000-memory.dmp

Download

memory/2032-564-0x000000000A000000-0x000000000A001000-memory.dmp

Download

memory/2032-284-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/2292-568-0x0000000004A30000-0x0000000004A31000-memory.dmp

Download

memory/2604-10-0x0000000007F40000-0x0000000007F46000-memory.dmp

Download

memory/2604-7-0x00000000055A0000-0x00000000055BF000-memory.dmp

Download

memory/2604-59-0x00000000050C0000-0x00000000050D1000-memory.dmp

Download

memory/2604-3-0x0000000000D40000-0x0000000000D41000-memory.dmp

Download

memory/2604-14-0x0000000009340000-0x0000000009341000-memory.dmp

Download

memory/2604-9-0x0000000007F60000-0x0000000007F61000-memory.dmp

Download

memory/2604-11-0x00000000082B0000-0x00000000082B1000-memory.dmp

Download

memory/2604-13-0x00000000097C0000-0x00000000097C1000-memory.dmp

Download

memory/2604-5-0x0000000005650000-0x0000000005651000-memory.dmp

Download

memory/2604-8-0x0000000008370000-0x0000000008371000-memory.dmp

Download

memory/2604-2-0x0000000073940000-0x000000007402E000-memory.dmp

Download

memory/2604-12-0x00000000090C0000-0x00000000090C1000-memory.dmp

Download

memory/2604-6-0x0000000002F90000-0x0000000002FA7000-memory.dmp

Download