warzonerat | fc2795532bba5d9bbdb746abaf999bf848677a9869e3d44bba53b5e60929aeac

General

Target

Proforma fatura.exe
Size

796KB
MD5

352a79b4fe6959ca79ab52e1366a5db0
SHA1

8f2dd9cc7b992a89e02852812342c4be170ba719
SHA256

fc2795532bba5d9bbdb746abaf999bf848677a9869e3d44bba53b5e60929aeac
SHA512

6bafe6792b06cb719fe84d74d3b8222d7f3358208cf597f2a6d73c05f9f526c832c9c908f47543cf39c2c02b22066169aab044f8839bec23bc28cfc9f89cc197

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

maxlogs.webhop.me:1619

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2268-4-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2268-5-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/2268-6-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

RegSvcs.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Windows\\Microsoft.NET\\Framework\\v2.0.50727\\RegSvcs.exe"	RegSvcs.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Proforma fatura.exe

description pid process target process

PID 648 set thread context of 2268 648 Proforma fatura.exe RegSvcs.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2012 schtasks.exe

description	pid	process	target process
PID 648 set thread context of 2268	648	Proforma fatura.exe	RegSvcs.exe

pid	process
2012	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Proforma fatura.exe

description	pid	process	target process
PID 648 wrote to memory of 2012	648	Proforma fatura.exe	schtasks.exe
PID 648 wrote to memory of 2012	648	Proforma fatura.exe	schtasks.exe
PID 648 wrote to memory of 2012	648	Proforma fatura.exe	schtasks.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe
PID 648 wrote to memory of 2268	648	Proforma fatura.exe	RegSvcs.exe

C:\Users\Admin\AppData\Local\Temp\Proforma fatura.exe
"C:\Users\Admin\AppData\Local\Temp\Proforma fatura.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:648

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JJfWWJrishTND" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7F52.tmp"
2⤵
- Creates scheduled task(s)
PID:2012

C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe
"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"
2⤵
- Adds Run key to start application
PID:2268

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7F52.tmp
MD5
c7acffb50d3fe0b820ce53bd53dbaadd

SHA1
a995306fe0845dbca255decf1e52ef96c9b4bfe0

SHA256
d2733c91dabafdde558f8a976afae004ca925ac53a3e44cd282a29fd039b492d

SHA512
ffb15b8c63b07bccb6169caf9c9ba909b8835c2358ba7f2371f1c055e3feb4814be40a6ab14ca21b385f3f0e4d6e64d06533fe08398fedfeda80b3da182efca8

Download Submit
memory/2012-2-0x0000000000000000-mapping.dmp

Download
memory/2268-4-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2268-5-0x0000000000405CE2-mapping.dmp

Download
memory/2268-6-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads