warzonerat | d266e212f266cc2c64e151d3543e34beaed2a3666fa215c2a88d8a042b6e9a4a

General

Target

POVdRnvBDNdZ0tZ.exe
Size

727KB
MD5

9710a8a9857b099694317f05c4da703e
SHA1

3faa03b1a2f63f42008c0a736b8faad86f114f5e
SHA256

d266e212f266cc2c64e151d3543e34beaed2a3666fa215c2a88d8a042b6e9a4a
SHA512

e9efa72bc615bc66a1747bd4db1a979a5f70eee68e859d0d807f26b5f11018000ac4b4d953d1133a3a719dd53cf4ea1710da9a37f2da3f95f88e0cd163a50efc

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

genasispony.hopto.org:4477

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/740-15-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/740-16-0x0000000000405738-mapping.dmp	warzonerat
behavioral2/memory/740-17-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

POVdRnvBDNdZ0tZ.exe

description pid process target process

PID 1152 set thread context of 740 1152 POVdRnvBDNdZ0tZ.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1652 schtasks.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

POVdRnvBDNdZ0tZ.exe

pid process

1152 POVdRnvBDNdZ0tZ.exe
1152 POVdRnvBDNdZ0tZ.exe
1152 POVdRnvBDNdZ0tZ.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

POVdRnvBDNdZ0tZ.exe

description pid process

Token: SeDebugPrivilege 1152 POVdRnvBDNdZ0tZ.exe

description	pid	process	target process
PID 1152 set thread context of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe

pid	process
1652	schtasks.exe

pid	process
1152	POVdRnvBDNdZ0tZ.exe
1152	POVdRnvBDNdZ0tZ.exe
1152	POVdRnvBDNdZ0tZ.exe

description	pid	process
Token: SeDebugPrivilege	1152	POVdRnvBDNdZ0tZ.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

POVdRnvBDNdZ0tZ.exe

description	pid	process	target process
PID 1152 wrote to memory of 1652	1152	POVdRnvBDNdZ0tZ.exe	schtasks.exe
PID 1152 wrote to memory of 1652	1152	POVdRnvBDNdZ0tZ.exe	schtasks.exe
PID 1152 wrote to memory of 1652	1152	POVdRnvBDNdZ0tZ.exe	schtasks.exe
PID 1152 wrote to memory of 736	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 736	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 736	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe
PID 1152 wrote to memory of 740	1152	POVdRnvBDNdZ0tZ.exe	MSBuild.exe

C:\Users\Admin\AppData\Local\Temp\POVdRnvBDNdZ0tZ.exe
"C:\Users\Admin\AppData\Local\Temp\POVdRnvBDNdZ0tZ.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SfyomJVdjkYkZC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD651.tmp"
2⤵
- Creates scheduled task(s)
PID:1652

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
PID:736

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"{path}"
2⤵
PID:740

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD651.tmp
MD5
cae5de5b6f0afa855239686d1a8d310c

SHA1
301b7cd0b5a1e0c1c8c5061d9bdbda1e8198e1e3

SHA256
eb8de1448f7032e4fbdb8389086618add3730b3d65703deee0300c8a04d30115

SHA512
80cfa63cc4fa592590a2afe22d27a30c7bb2fa75159686945a661e5e58ac6715a9f1e1adf2a8ace9b36d3d7eb84e5a488f039443e7d9a534fb9df14043161bec

Download Submit
memory/740-18-0x00000000038B0000-0x0000000003934000-memory.dmp

Filesize
528KB

Download
memory/740-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/740-16-0x0000000000405738-mapping.dmp

Download
memory/740-15-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1152-7-0x00000000051F0000-0x00000000051F1000-memory.dmp

Filesize
4KB

Download
memory/1152-9-0x0000000008870000-0x0000000008871000-memory.dmp

Filesize
4KB

Download
memory/1152-10-0x00000000054F0000-0x00000000054F5000-memory.dmp

Filesize
20KB

Download
memory/1152-11-0x00000000087D0000-0x000000000886E000-memory.dmp

Filesize
632KB

Download
memory/1152-12-0x000000000B0D0000-0x000000000B120000-memory.dmp

Filesize
320KB

Download
memory/1152-8-0x00000000053D0000-0x00000000053D1000-memory.dmp

Filesize
4KB

Download
memory/1152-2-0x0000000073450000-0x0000000073B3E000-memory.dmp

Filesize
6.9MB

Download
memory/1152-6-0x0000000005210000-0x0000000005211000-memory.dmp

Filesize
4KB

Download
memory/1152-5-0x0000000005800000-0x0000000005801000-memory.dmp

Filesize
4KB

Download
memory/1152-3-0x0000000000910000-0x0000000000911000-memory.dmp

Filesize
4KB

Download
memory/1652-13-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads