warzonerat | c5d7cbbe95c1ee46f8e76cd859295e56376a2b8985c2f50355e50fd966f05cd4

General

Target

T31597760-Confirm-20210520-100016-Email-1574401.exe
Size

1006KB
MD5

8addb03660ac849d116990b2c3f4bad8
SHA1

f47dc617f55d4f8e7a06cc729b08ed1a5f2f518e
SHA256

c5d7cbbe95c1ee46f8e76cd859295e56376a2b8985c2f50355e50fd966f05cd4
SHA512

9a676bd4abe764dd774de5b678333af00211a7a0e7266054368697f35cb48a6df377f7d40eb1edc92a6e937028d9241ee29a40f4dd7a40fddebffe1811b5e93a

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

157.55.136.23:5300

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1900-68-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1900-69-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/1900-71-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

T31597760-Confirm-20210520-100016-Email-1574401.exe

description	pid	process	target process
PID 1888 set thread context of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1076 schtasks.exe

pid	process
1076	schtasks.exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

T31597760-Confirm-20210520-100016-Email-1574401.exe

C:\Users\Admin\AppData\Local\Temp\T31597760-Confirm-20210520-100016-Email-1574401.exe
"C:\Users\Admin\AppData\Local\Temp\T31597760-Confirm-20210520-100016-Email-1574401.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BRVYYClLxOEzsy" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB0F7.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1076
- C:\Users\Admin\AppData\Local\Temp\T31597760-Confirm-20210520-100016-Email-1574401.exe
  "C:\Users\Admin\AppData\Local\Temp\T31597760-Confirm-20210520-100016-Email-1574401.exe"
  2⤵
  PID:1900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpB0F7.tmp

MD5
5abe1665501406cba05f9dc82da12473

SHA1
e6d0c98cfe997454cd0154ba2bb6ae219208e36d

SHA256
78c993e1a8954ef1fc0f99ea374bbd0fd68c25e2dacaa5f69cd8c5ea02e427af

SHA512
89aa115a7fc670bce2449ac331a0be98bfdd1b0ff26936c84c1a15dc46933a7f7405bc1dc5a10b62861b61243a3f7b8b95857ee57c35a18f27af31f484fe8193

Download Submit
memory/1076-66-0x0000000000000000-mapping.dmp

Download
memory/1888-60-0x0000000001070000-0x0000000001071000-memory.dmp

Filesize
4KB

Download
memory/1888-62-0x0000000004C30000-0x0000000004C31000-memory.dmp

Filesize
4KB

Download
memory/1888-63-0x0000000000500000-0x0000000000505000-memory.dmp

Filesize
20KB

Download
memory/1888-64-0x00000000050D0000-0x0000000005171000-memory.dmp

Filesize
644KB

Download
memory/1888-65-0x0000000001010000-0x000000000106D000-memory.dmp

Filesize
372KB

Download
memory/1900-68-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1900-69-0x0000000000405CE2-mapping.dmp

Download
memory/1900-70-0x0000000075161000-0x0000000075163000-memory.dmp

Filesize
8KB

Download
memory/1900-71-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

description	pid	process	target process
PID 1888 wrote to memory of 1076	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	schtasks.exe
PID 1888 wrote to memory of 1076	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	schtasks.exe
PID 1888 wrote to memory of 1076	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	schtasks.exe
PID 1888 wrote to memory of 1076	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	schtasks.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe
PID 1888 wrote to memory of 1900	1888	T31597760-Confirm-20210520-100016-Email-1574401.exe	T31597760-Confirm-20210520-100016-Email-1574401.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads