warzonerat | f1b5c3f7c1ee438590757e114f1c379f6c3d5fc7b349cad583976106737beb61

General

Target

klz4gyUavm3BYrK.exe
Size

589KB
MD5

a4f1d30c779341883a5aa160f647eea6
SHA1

64b7e6d3afe4c776c7ce70451e9f02ffaa1e1aec
SHA256

f1b5c3f7c1ee438590757e114f1c379f6c3d5fc7b349cad583976106737beb61
SHA512

995027ec72c69dc4ce81ef07d7f3c4106f9e1fc9301dce02336fe5c99c1e941716f2e76c3d80e488368af6ea5a61eb024bd779a605e71eba1a6a4afc48257b63

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

genasispony.hopto.org:4477

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1616-15-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/1616-16-0x0000000000405738-mapping.dmp	warzonerat
behavioral2/memory/1616-17-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

klz4gyUavm3BYrK.exe

description pid process target process

PID 1456 set thread context of 1616 1456 klz4gyUavm3BYrK.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2068 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

klz4gyUavm3BYrK.exe

pid process

1456 klz4gyUavm3BYrK.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

klz4gyUavm3BYrK.exe

description pid process

Token: SeDebugPrivilege 1456 klz4gyUavm3BYrK.exe

description	pid	process	target process
PID 1456 set thread context of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe

pid	process
2068	schtasks.exe

pid	process
1456	klz4gyUavm3BYrK.exe

description	pid	process
Token: SeDebugPrivilege	1456	klz4gyUavm3BYrK.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

klz4gyUavm3BYrK.exe

description	pid	process	target process
PID 1456 wrote to memory of 2068	1456	klz4gyUavm3BYrK.exe	schtasks.exe
PID 1456 wrote to memory of 2068	1456	klz4gyUavm3BYrK.exe	schtasks.exe
PID 1456 wrote to memory of 2068	1456	klz4gyUavm3BYrK.exe	schtasks.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe
PID 1456 wrote to memory of 1616	1456	klz4gyUavm3BYrK.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\klz4gyUavm3BYrK.exe
"C:\Users\Admin\AppData\Local\Temp\klz4gyUavm3BYrK.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1456

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FSIEmqZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3181.tmp"
2⤵
- Creates scheduled task(s)
PID:2068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
PID:1616

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp3181.tmp
MD5
3b93dcf3c0249eb274434478e21ff0d9

SHA1
a775749f24009b1ffe249f820c8d7ad36c8d719b

SHA256
fab1fa631c97f9ad473f80f389403198143edbf39d47bdc9358dbb4d0cf51fda

SHA512
bcbbe7e88cff619d4660243cee0d847346695c169fe9f6353e8044dc5e434f71eb1a9e5b0c4d0b0aa6b90176e1c777ce0127d2ebb04058d022bd96aa518ead4c

Download Submit
memory/1456-11-0x00000000055C0000-0x00000000055C1000-memory.dmp

Filesize
4KB

Download
memory/1456-12-0x0000000008840000-0x000000000888D000-memory.dmp

Filesize
308KB

Download
memory/1456-6-0x0000000005430000-0x0000000005431000-memory.dmp

Filesize
4KB

Download
memory/1456-7-0x00000000055D0000-0x00000000055D1000-memory.dmp

Filesize
4KB

Download
memory/1456-8-0x00000000053D0000-0x00000000053D5000-memory.dmp

Filesize
20KB

Download
memory/1456-9-0x0000000005750000-0x0000000005751000-memory.dmp

Filesize
4KB

Download
memory/1456-5-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/1456-2-0x0000000073550000-0x0000000073C3E000-memory.dmp

Filesize
6.9MB

Download
memory/1456-10-0x00000000063E0000-0x000000000647B000-memory.dmp

Filesize
620KB

Download
memory/1456-3-0x0000000000B30000-0x0000000000B31000-memory.dmp

Filesize
4KB

Download
memory/1616-15-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1616-16-0x0000000000405738-mapping.dmp

Download
memory/1616-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1616-18-0x00000000036D0000-0x0000000003754000-memory.dmp

Filesize
528KB

Download
memory/2068-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads