warzonerat | fc2795532bba5d9bbdb746abaf999bf848677a9869e3d44bba53b5e60929aeac

General

Target

Proforma fatura.exe
Size

796KB
MD5

352a79b4fe6959ca79ab52e1366a5db0
SHA1

8f2dd9cc7b992a89e02852812342c4be170ba719
SHA256

fc2795532bba5d9bbdb746abaf999bf848677a9869e3d44bba53b5e60929aeac
SHA512

6bafe6792b06cb719fe84d74d3b8222d7f3358208cf597f2a6d73c05f9f526c832c9c908f47543cf39c2c02b22066169aab044f8839bec23bc28cfc9f89cc197

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

maxlogs.webhop.me:1619

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1020-4-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1020-5-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/1020-6-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Proforma fatura.exe

description pid process target process

PID 648 set thread context of 1020 648 Proforma fatura.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1728 schtasks.exe

description	pid	process	target process
PID 648 set thread context of 1020	648	Proforma fatura.exe	RegSvcs.exe

pid	process
1728	schtasks.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Proforma fatura.exe

description	pid	process	target process
PID 648 wrote to memory of 1728	648	Proforma fatura.exe	schtasks.exe
PID 648 wrote to memory of 1728	648	Proforma fatura.exe	schtasks.exe
PID 648 wrote to memory of 1728	648	Proforma fatura.exe	schtasks.exe
PID 648 wrote to memory of 1728	648	Proforma fatura.exe	schtasks.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 1020	648	Proforma fatura.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Proforma fatura.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma fatura.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JJfWWJrishTND" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD826.tmp"
2⤵
- Creates scheduled task(s)
PID:1728

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Adds Run key to start application
PID:1020

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD826.tmp
MD5
00150a205351f531b3958cb731d0afe7

SHA1
51fd0b7915abefa6e7917e277c25fcb36c510d99

SHA256
b20609ba29755b27da01880454717285cf37c7832ee75edd5269c3b78dc81f1d

SHA512
8c66c8704fb310b786b711621eb910050a848a4761caa62853a67767715a98f89627b0636dafe781857e47e5b0aba9d2860e18b0dc284a1a942e07b9d8a01362

Download Submit
memory/1020-4-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1020-5-0x0000000000405CE2-mapping.dmp

Download
memory/1020-6-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1728-2-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads