warzonerat | 8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb

Analysis

max time kernel
145s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
28/02/2021, 07:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
Size 538KB
Sample210228-mcgq2mgcxe
SHA256 8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb
MD5 6e04d11045fd7e1a433ca7f6938fe4d0
SHA1 3100d9335036fd72eb2213b218e57e62a4c66cc7
SHA512 eba8b5deaa425f010534ab26f17f84002a3bee64007e6459d50f5e775753db37b6059af9cd77005a7bb6259ed9fa721ce963c45f1629bc56e6bf8f5be77232c1
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat spyware

Malware Config

Extracted

Family

warzonerat

185.128.25.29:5200

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 768 created 1152	768	WerFault.exe	44

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/2976-4-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2976-5-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/2976-8-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3784-19-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/3784-22-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 5 IoCs

pid	Process
2992	winldjris.exe
2976	winldjris.exe
1296	imagew.exe
2720	winldjris.exe
3784	winldjris.exe

Loads dropped DLL 6 IoCs

pid	Process
3784	winldjris.exe
3784	winldjris.exe
3784	winldjris.exe
3784	winldjris.exe
3784	winldjris.exe
3784	winldjris.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Imagespng = "C:\\ProgramData\\imagew.exe"	winldjris.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1296 set thread context of 3784	1296	imagew.exe	86

Program crash 3 IoCs

pid	pid_target	Process	procid_target
1516	1152	WerFault.exe	44
768	1152	WerFault.exe	44
648	1296	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 59 IoCs

pid	Process
1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
1516	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
768	WerFault.exe
1296	imagew.exe
1296	imagew.exe
1296	imagew.exe
1296	imagew.exe
1296	imagew.exe
1296	imagew.exe
1296	imagew.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe
648	WerFault.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
Token: 33	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
Token: SeIncBasePriorityPrivilege	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
Token: SeRestorePrivilege	1516	WerFault.exe
Token: SeBackupPrivilege	1516	WerFault.exe
Token: SeDebugPrivilege	1516	WerFault.exe
Token: SeDebugPrivilege	768	WerFault.exe
Token: SeDebugPrivilege	1296	imagew.exe
Token: 33	1296	imagew.exe
Token: SeIncBasePriorityPrivilege	1296	imagew.exe
Token: SeDebugPrivilege	648	WerFault.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3784	winldjris.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2992	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	78
PID 1152 wrote to memory of 2992	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	78
PID 1152 wrote to memory of 2992	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	78
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 1152 wrote to memory of 2976	1152	8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe	79
PID 2976 wrote to memory of 1296	2976	winldjris.exe	83
PID 2976 wrote to memory of 1296	2976	winldjris.exe	83
PID 2976 wrote to memory of 1296	2976	winldjris.exe	83
PID 1296 wrote to memory of 2720	1296	imagew.exe	85
PID 1296 wrote to memory of 2720	1296	imagew.exe	85
PID 1296 wrote to memory of 2720	1296	imagew.exe	85
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 1296 wrote to memory of 3784	1296	imagew.exe	86
PID 3784 wrote to memory of 3320	3784	winldjris.exe	88
PID 3784 wrote to memory of 3320	3784	winldjris.exe	88
PID 3784 wrote to memory of 3320	3784	winldjris.exe	88
PID 3784 wrote to memory of 3320	3784	winldjris.exe	88
PID 3784 wrote to memory of 3320	3784	winldjris.exe	88

C:\Users\Admin\AppData\Local\Temp\8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe
"C:\Users\Admin\AppData\Local\Temp\8870e414ae7cec6f996da728f1366eb10940a81823abbfd13fbd0f97da1585bb.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe
  "C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe"
  2⤵
  - Executes dropped EXE
  PID:2992
- C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe
  "C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2976
- - C:\ProgramData\imagew.exe
    "C:\ProgramData\imagew.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1296
  - - C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe
      "C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe"
      4⤵
      Executes dropped EXE
      PID:2720
  - - C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe
      "C:\Users\Admin\AppData\Local\Temp\6QDF15IfL6g7dmeB\winldjris.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3784
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:3320
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 1044
      4⤵
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:648
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 1084
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1516
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1152 -s 1104
  2⤵
  - Suspicious use of NtCreateProcessExOtherParentProcess
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-21-0x00000000048A0000-0x00000000048A1000-memory.dmp

Download

memory/768-9-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Download

memory/768-10-0x0000000004CD0000-0x0000000004CD1000-memory.dmp

Download

memory/1152-2-0x0000000002D70000-0x0000000002D71000-memory.dmp

Download

memory/1296-16-0x00000000016C0000-0x00000000016C1000-memory.dmp

Download

memory/1516-7-0x0000000004760000-0x0000000004761000-memory.dmp

Download

memory/2976-8-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2976-4-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3320-24-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download

memory/3784-22-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3784-26-0x0000000004C30000-0x0000000004CB4000-memory.dmp

Download

memory/3784-25-0x0000000004790000-0x00000000048CC000-memory.dmp

Download