warzonerat | 0288f149c280ae5dc3a27ab06b9cfc41582635226b9759e1aebe4d3e641074b4

General

Target

SCB_MT103_31951R2105050031_200505.PDF.exe
Size

919KB
MD5

cf3e6f4dd1b47b5e9f09f9b1165bb519
SHA1

68a1a10ad6b7eaa3d95b7eabefb53097cd44845f
SHA256

0288f149c280ae5dc3a27ab06b9cfc41582635226b9759e1aebe4d3e641074b4
SHA512

ac7c777dd47373c5a69c56e0948781c77a18731b630916ebbdae354f32ffd05c7e569f6d2b78fc61d4babc7537cf0126fa28c83246a2d2a75fcf499d36628148

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

157.55.136.23:5300

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/940-68-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/940-67-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/940-70-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

SCB_MT103_31951R2105050031_200505.PDF.exe

description	pid	process	target process
PID 1072 set thread context of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1108 schtasks.exe

pid	process
1108	schtasks.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

SCB_MT103_31951R2105050031_200505.PDF.exe

C:\Users\Admin\AppData\Local\Temp\SCB_MT103_31951R2105050031_200505.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\SCB_MT103_31951R2105050031_200505.PDF.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kBnYsHjsxpep" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9D1A.tmp"
2⤵
- Creates scheduled task(s)
PID:1108

C:\Users\Admin\AppData\Local\Temp\SCB_MT103_31951R2105050031_200505.PDF.exe
"C:\Users\Admin\AppData\Local\Temp\SCB_MT103_31951R2105050031_200505.PDF.exe"
2⤵
PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9D1A.tmp
MD5
f5589598d8c03a6398621b050afc46f4

SHA1
3113d2ca30d852b9db1d480a55638ded866027d2

SHA256
f68d19dc6333ce416f2a1db85f95294e6ad0028632b5efd0913192f6e42fe3dc

SHA512
9a68826ac1c44486a57931da08bf4bd2b626e85a19ee417f96a0ddad52d70c7dbad825c49e0cc21afbe9fbbfb6584e995ee9edc3151e6ce2fb61c7f12a4365e6

Download Submit
memory/940-68-0x0000000000405CE2-mapping.dmp

Download
memory/940-67-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/940-69-0x0000000075411000-0x0000000075413000-memory.dmp

Filesize
8KB

Download
memory/940-70-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1072-59-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1072-61-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

Filesize
4KB

Download
memory/1072-62-0x00000000006E0000-0x00000000006EE000-memory.dmp

Filesize
56KB

Download
memory/1072-63-0x0000000004F30000-0x0000000004FCD000-memory.dmp

Filesize
628KB

Download
memory/1072-64-0x0000000005010000-0x0000000005068000-memory.dmp

Filesize
352KB

Download
memory/1108-65-0x0000000000000000-mapping.dmp

Download

description	pid	process	target process
PID 1072 wrote to memory of 1108	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	schtasks.exe
PID 1072 wrote to memory of 1108	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	schtasks.exe
PID 1072 wrote to memory of 1108	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	schtasks.exe
PID 1072 wrote to memory of 1108	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	schtasks.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe
PID 1072 wrote to memory of 940	1072	SCB_MT103_31951R2105050031_200505.PDF.exe	SCB_MT103_31951R2105050031_200505.PDF.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads