warzonerat | 8d9da1d788ebe7f59e20c10e6283757e407a2e3befc63b4df9df138d3277b39c

Analysis

max time kernel
135s
max time network
144s
platform
windows10_x64
resource
win10v20201028
submitted
10/02/2021, 07:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0110199383737338466578282847.scr
Size 201KB
Sample210210-5165kbaefs
SHA256 8d9da1d788ebe7f59e20c10e6283757e407a2e3befc63b4df9df138d3277b39c
MD5 67c1edd5ba59823b2817a48a8cc5a9e1
SHA1 e7b2c1022dbc3df1142052019d2eca990e4a0cee
SHA512 8b8a4ca731a1ac07a8598484e28c219a4679d574db4b745f0bd7f36eee05d61d4569183af97c992d8de28bd58a5d3dfb359a5e9e1e97c30f746383e1f48cf3ed
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

xchilogs.duckdns.org:23489

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/744-5-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Loads dropped DLL 2 IoCs

pid	Process
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\name = "C:\\Users\\Admin\\AppData\\Roaming\\folder\\file.exe"	0110199383737338466578282847.scr

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4756 set thread context of 744	4756	0110199383737338466578282847.scr	75

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr
4756	0110199383737338466578282847.scr

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4756	0110199383737338466578282847.scr

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 744	4756	0110199383737338466578282847.scr	75
PID 4756 wrote to memory of 744	4756	0110199383737338466578282847.scr	75
PID 4756 wrote to memory of 744	4756	0110199383737338466578282847.scr	75
PID 4756 wrote to memory of 744	4756	0110199383737338466578282847.scr	75

C:\Users\Admin\AppData\Local\Temp\0110199383737338466578282847.scr
"C:\Users\Admin\AppData\Local\Temp\0110199383737338466578282847.scr" /S
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Users\Admin\AppData\Local\Temp\0110199383737338466578282847.scr
  "C:\Users\Admin\AppData\Local\Temp\0110199383737338466578282847.scr" /S
  2⤵
  PID:744

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/744-5-0x0000000000400000-0x0000000000554000-memory.dmp

Download