warzonerat | 87783bb0a6d5e2846ba2b5e097fe49b9dafe36995916908fdb11e5170e81ac00

General

Target

payment proof.png.exe
Size

489KB
MD5

fb629e1391366b36827b6982c93da4c3
SHA1

3480ddeb9862c6ec1a19349b4fb248e89fc8b040
SHA256

87783bb0a6d5e2846ba2b5e097fe49b9dafe36995916908fdb11e5170e81ac00
SHA512

8edbaa68c89dcf6c4d69b54bdb8dbbb91c4d24d94f118f7f8037c34d68356dbaab360cab3fcb51738c155c37c75bc9c26ef9ed6a0119e41b154fb39d03c33538

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

79.134.225.26:3141

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Suspicious use of SetThreadContext 1 IoCs

Processes:

payment proof.png.exe

description pid process target process

PID 276 set thread context of 1472 276 payment proof.png.exe payment proof.png.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

900 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

payment proof.png.exe

pid process

276 payment proof.png.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

payment proof.png.exe

description pid process

Token: SeDebugPrivilege 276 payment proof.png.exe

description	pid	process	target process
PID 276 set thread context of 1472	276	payment proof.png.exe	payment proof.png.exe

pid	process
900	schtasks.exe

pid	process
276	payment proof.png.exe

description	pid	process
Token: SeDebugPrivilege	276	payment proof.png.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

payment proof.png.exe

description	pid	process	target process
PID 276 wrote to memory of 900	276	payment proof.png.exe	schtasks.exe
PID 276 wrote to memory of 900	276	payment proof.png.exe	schtasks.exe
PID 276 wrote to memory of 900	276	payment proof.png.exe	schtasks.exe
PID 276 wrote to memory of 900	276	payment proof.png.exe	schtasks.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe
PID 276 wrote to memory of 1472	276	payment proof.png.exe	payment proof.png.exe

C:\Users\Admin\AppData\Local\Temp\payment proof.png.exe
"C:\Users\Admin\AppData\Local\Temp\payment proof.png.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:276
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OwnXFRdBm" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9608.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:900
- C:\Users\Admin\AppData\Local\Temp\payment proof.png.exe
  "{path}"
  2⤵
  PID:1472

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9608.tmp

MD5
c4870dc2441b3b3bfea794b18bad0cbe

SHA1
db8795f930bc7afbf28a77c2700168b707a1afe1

SHA256
5f7b23b756e47b0701c572b40fe69ef363516cf0f18e53f985437efd03f1c90b

SHA512
c090be7a2c2591cdedd1b810fd7c588117762b4568648f0fd44e0861f71cf2932308ee6687c4a9ba5bd3e7d134a8372842f12ce9bbd54537368b30c67c0838d2

Download Submit
memory/276-9-0x0000000004C90000-0x0000000004CC1000-memory.dmp

Filesize
196KB

Download
memory/276-5-0x0000000000A60000-0x0000000000A61000-memory.dmp

Filesize
4KB

Download
memory/276-6-0x0000000000480000-0x0000000000482000-memory.dmp

Filesize
8KB

Download
memory/276-7-0x000000007EF40000-0x000000007EF41000-memory.dmp

Filesize
4KB

Download
memory/276-8-0x0000000005BC0000-0x0000000005C31000-memory.dmp

Filesize
452KB

Download
memory/276-2-0x00000000747A0000-0x0000000074E8E000-memory.dmp

Filesize
6.9MB

Download
memory/276-3-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/900-10-0x0000000000000000-mapping.dmp

Download
memory/1472-12-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1472-13-0x0000000000405E28-mapping.dmp

Download
memory/1472-14-0x00000000765E1000-0x00000000765E3000-memory.dmp

Filesize
8KB

Download
memory/1472-15-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads