warzonerat | e5afa3d0aadbf3c559d41ae3b354e4258230de01d6514de7fd3133c1f3b6306c | Triage

Analysis

max time kernel
29s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
12-01-2021 14:13

Sharing

Report Analysis Logs

General

Target

iv.exe
Size

1.5MB
MD5

0adb632989ec9dcdcde9f532288cbe3d
SHA1

acdac4bd2b7f53f1a598e8847f2a61be68664d2d
SHA256

e5afa3d0aadbf3c559d41ae3b354e4258230de01d6514de7fd3133c1f3b6306c
SHA512

a309898d7df1f037d11c2937b9fe498d0c9a9cecbf3150b36ac2f1ac8ac98d3c71253762b38a7d8ecd0843a55f3672df277e7323b08a18fd1d84a8dec1ee43a1

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

95.217.251.120:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Drops startup file 2 IoCs

Processes:

iv.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	iv.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	iv.exe

NTFS ADS 2 IoCs

Processes:

iv.exe

description ioc process

File created C:\ProgramData:ApplicationData iv.exe
File opened for modification C:\ProgramData:ApplicationData iv.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

iv.exe

pid process

1048 iv.exe
1048 iv.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

iv.exe

description	pid	process	target process
PID 1048 wrote to memory of 3040	1048	iv.exe	Explorer.EXE
PID 1048 wrote to memory of 3040	1048	iv.exe	Explorer.EXE
PID 1048 wrote to memory of 3324	1048	iv.exe	cmd.exe
PID 1048 wrote to memory of 3324	1048	iv.exe	cmd.exe
PID 1048 wrote to memory of 3324	1048	iv.exe	cmd.exe
PID 1048 wrote to memory of 3324	1048	iv.exe	cmd.exe
PID 1048 wrote to memory of 3324	1048	iv.exe	cmd.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:3040
- C:\Users\Admin\AppData\Local\Temp\iv.exe
  "C:\Users\Admin\AppData\Local\Temp\iv.exe"
  2⤵
  - Drops startup file
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:3324

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1048-2-0x0000000003550000-0x00000000036AD000-memory.dmp

Filesize
1.4MB

Download
memory/3324-3-0x0000000000000000-mapping.dmp

Download
memory/3324-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

Filesize
4KB

Download