warzonerat | 8fa012cc7bebb93ce19f2d74819faccf7ce9d7aad53c65373432d794726506e5

General

Target

catalogue_2021_samples_list_revised.exe
Size

1.3MB
MD5

e273cbf8e92730099ee6eec6a983872e
SHA1

61ff93049d83312f75dfb46ff3cf928a10950a5a
SHA256

8fa012cc7bebb93ce19f2d74819faccf7ce9d7aad53c65373432d794726506e5
SHA512

2dffe3d810b494b31c5adef6641a104b4937c265340fffd5441a8c3cbd20808848c2e3ff66dfcd97651592e2c74be148abd1a11963050d4b430785ef8cc97aed

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

52.146.42.226:5600

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3540-14-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3540-15-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/3540-16-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

catalogue_2021_samples_list_revised.exe

description	pid	process	target process
PID 1400 set thread context of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

3820 schtasks.exe

pid	process
3820	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

catalogue_2021_samples_list_revised.exe

description	pid	process	target process
PID 1400 wrote to memory of 3820	1400	catalogue_2021_samples_list_revised.exe	schtasks.exe
PID 1400 wrote to memory of 3820	1400	catalogue_2021_samples_list_revised.exe	schtasks.exe
PID 1400 wrote to memory of 3820	1400	catalogue_2021_samples_list_revised.exe	schtasks.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe
PID 1400 wrote to memory of 3540	1400	catalogue_2021_samples_list_revised.exe	catalogue_2021_samples_list_revised.exe

C:\Users\Admin\AppData\Local\Temp\catalogue_2021_samples_list_revised.exe
"C:\Users\Admin\AppData\Local\Temp\catalogue_2021_samples_list_revised.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\VnEXCLZgXsVEE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4845.tmp"
2⤵
- Creates scheduled task(s)
PID:3820

C:\Users\Admin\AppData\Local\Temp\catalogue_2021_samples_list_revised.exe
"C:\Users\Admin\AppData\Local\Temp\catalogue_2021_samples_list_revised.exe"
2⤵
PID:3540

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4845.tmp
MD5
3becbb95b9b37a376f4289259e03739c

SHA1
4f64a57e61396d61b90290b92272869b5b5fea0f

SHA256
53e39b407e1e960c7799ad74953bd33a98cf6138b0e6690f0320d0c4ed229aa1

SHA512
1ee28ee1ff3879487e604152bd078540e483c25c559754391b0ecc3b4061d976d8aa8dbd67580efa6870063ffa991caf5da2b3aff9d38d209337d314736c7cb0

Download Submit
memory/1400-9-0x0000000005160000-0x0000000005161000-memory.dmp

Filesize
4KB

Download
memory/1400-5-0x0000000004E10000-0x0000000004E11000-memory.dmp

Filesize
4KB

Download
memory/1400-6-0x0000000005450000-0x0000000005451000-memory.dmp

Filesize
4KB

Download
memory/1400-7-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/1400-8-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

Filesize
4KB

Download
memory/1400-2-0x0000000073FB0000-0x000000007469E000-memory.dmp

Filesize
6.9MB

Download
memory/1400-10-0x0000000004F20000-0x0000000004F32000-memory.dmp

Filesize
72KB

Download
memory/1400-11-0x0000000005CE0000-0x0000000005D3B000-memory.dmp

Filesize
364KB

Download
memory/1400-3-0x00000000004F0000-0x00000000004F1000-memory.dmp

Filesize
4KB

Download
memory/3540-14-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3540-15-0x0000000000405CE2-mapping.dmp

Download
memory/3540-16-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3820-12-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads