warzonerat | f1b5c3f7c1ee438590757e114f1c379f6c3d5fc7b349cad583976106737beb61

General

Target

klz4gyUavm3BYrK.exe
Size

589KB
MD5

a4f1d30c779341883a5aa160f647eea6
SHA1

64b7e6d3afe4c776c7ce70451e9f02ffaa1e1aec
SHA256

f1b5c3f7c1ee438590757e114f1c379f6c3d5fc7b349cad583976106737beb61
SHA512

995027ec72c69dc4ce81ef07d7f3c4106f9e1fc9301dce02336fe5c99c1e941716f2e76c3d80e488368af6ea5a61eb024bd779a605e71eba1a6a4afc48257b63

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

genasispony.hopto.org:4477

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1328-11-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/1328-12-0x0000000000405738-mapping.dmp	warzonerat
behavioral1/memory/1328-16-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

klz4gyUavm3BYrK.exe

description pid process target process

PID 1852 set thread context of 1328 1852 klz4gyUavm3BYrK.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1316 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

klz4gyUavm3BYrK.exe

pid process

1852 klz4gyUavm3BYrK.exe
1852 klz4gyUavm3BYrK.exe
1852 klz4gyUavm3BYrK.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

klz4gyUavm3BYrK.exe

description pid process

Token: SeDebugPrivilege 1852 klz4gyUavm3BYrK.exe

description	pid	process	target process
PID 1852 set thread context of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe

pid	process
1316	schtasks.exe

pid	process
1852	klz4gyUavm3BYrK.exe
1852	klz4gyUavm3BYrK.exe
1852	klz4gyUavm3BYrK.exe

description	pid	process
Token: SeDebugPrivilege	1852	klz4gyUavm3BYrK.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

klz4gyUavm3BYrK.exe

description	pid	process	target process
PID 1852 wrote to memory of 1316	1852	klz4gyUavm3BYrK.exe	schtasks.exe
PID 1852 wrote to memory of 1316	1852	klz4gyUavm3BYrK.exe	schtasks.exe
PID 1852 wrote to memory of 1316	1852	klz4gyUavm3BYrK.exe	schtasks.exe
PID 1852 wrote to memory of 1316	1852	klz4gyUavm3BYrK.exe	schtasks.exe
PID 1852 wrote to memory of 316	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 316	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 316	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 316	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1852 wrote to memory of 1328	1852	klz4gyUavm3BYrK.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\klz4gyUavm3BYrK.exe
"C:\Users\Admin\AppData\Local\Temp\klz4gyUavm3BYrK.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FSIEmqZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2EBE.tmp"
2⤵
- Creates scheduled task(s)
PID:1316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
PID:316

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
PID:1328

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2EBE.tmp
MD5
58e25ab78123786f4584f3fed78c3a28

SHA1
90f57bd17bd557b1b3a98cc818ca93319d16e80a

SHA256
5f49e512a21baab316fc0f2fef36c122c68c35b35992e5c936b10f3254bb3d59

SHA512
d53598c3ac869bca349d2dfa0dab642770a1edefcf9ff8c95c8816859227a7b87c7e24d219911ac03ffb979afbc3557086d15959af647ad1950e63f60a5256b4

Download Submit
memory/1268-18-0x000007FEF7FE0000-0x000007FEF825A000-memory.dmp

Filesize
2.5MB

Download
memory/1316-9-0x0000000000000000-mapping.dmp

Download
memory/1328-12-0x0000000000405738-mapping.dmp

Download
memory/1328-11-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1328-13-0x00000000760F1000-0x00000000760F3000-memory.dmp

Filesize
8KB

Download
memory/1328-16-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1328-17-0x0000000002EF0000-0x0000000002F74000-memory.dmp

Filesize
528KB

Download
memory/1852-7-0x00000000055B0000-0x000000000564B000-memory.dmp

Filesize
620KB

Download
memory/1852-8-0x0000000004D30000-0x0000000004D7D000-memory.dmp

Filesize
308KB

Download
memory/1852-6-0x0000000000C80000-0x0000000000C81000-memory.dmp

Filesize
4KB

Download
memory/1852-5-0x00000000008C0000-0x00000000008C5000-memory.dmp

Filesize
20KB

Download
memory/1852-2-0x0000000074570000-0x0000000074C5E000-memory.dmp

Filesize
6.9MB

Download
memory/1852-3-0x00000000011B0000-0x00000000011B1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads