warzonerat | a8e9ff8520a1ddf67e25641f39246976117be887b68d8bc24c890ae511723254

General

Target

SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
Size

1.3MB
MD5

e7e098ec6c3ca85ffd4cb7f2c4605311
SHA1

8d300f5e2ca8375173de14d4319209f16fc1c10e
SHA256

a8e9ff8520a1ddf67e25641f39246976117be887b68d8bc24c890ae511723254
SHA512

4ba3b152268116d36c33e5e1a7f079b907d68465084da8725225b08de4ffaadc42bc9464806b359ab197031be2bb7554c1d422773f66bc469b2701d96a0b77d0

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

79.134.225.94:5352

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4040-126-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/4040-125-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4040-127-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2136-139-0x0000000005240000-0x000000000573E000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

Processes:

images.exe

pid process

2136 images.exe

pid	process
2136	images.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe

description	pid	process	target process
PID 3912 set thread context of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exeSecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe

description	pid	process	target process
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 3912 wrote to memory of 4040	3912	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
PID 4040 wrote to memory of 2136	4040	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	images.exe
PID 4040 wrote to memory of 2136	4040	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	images.exe
PID 4040 wrote to memory of 2136	4040	SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe	images.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.16917.11217.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4040
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    PID:2136

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\images.exe

MD5
e7e098ec6c3ca85ffd4cb7f2c4605311

SHA1
8d300f5e2ca8375173de14d4319209f16fc1c10e

SHA256
a8e9ff8520a1ddf67e25641f39246976117be887b68d8bc24c890ae511723254

SHA512
4ba3b152268116d36c33e5e1a7f079b907d68465084da8725225b08de4ffaadc42bc9464806b359ab197031be2bb7554c1d422773f66bc469b2701d96a0b77d0

Download Submit
C:\ProgramData\images.exe

MD5
e7e098ec6c3ca85ffd4cb7f2c4605311

SHA1
8d300f5e2ca8375173de14d4319209f16fc1c10e

SHA256
a8e9ff8520a1ddf67e25641f39246976117be887b68d8bc24c890ae511723254

SHA512
4ba3b152268116d36c33e5e1a7f079b907d68465084da8725225b08de4ffaadc42bc9464806b359ab197031be2bb7554c1d422773f66bc469b2701d96a0b77d0

Download Submit
memory/2136-128-0x0000000000000000-mapping.dmp

Download
memory/2136-139-0x0000000005240000-0x000000000573E000-memory.dmp

Filesize
5.0MB

Download
memory/3912-123-0x0000000005890000-0x000000000590C000-memory.dmp

Filesize
496KB

Download
memory/3912-120-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

Filesize
4KB

Download
memory/3912-121-0x0000000004B00000-0x0000000004B1E000-memory.dmp

Filesize
120KB

Download
memory/3912-122-0x0000000004C10000-0x000000000510E000-memory.dmp

Filesize
5.0MB

Download
memory/3912-114-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/3912-124-0x0000000007E00000-0x0000000007E35000-memory.dmp

Filesize
212KB

Download
memory/3912-119-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/3912-118-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/3912-117-0x0000000005110000-0x0000000005111000-memory.dmp

Filesize
4KB

Download
memory/3912-116-0x0000000004B70000-0x0000000004B71000-memory.dmp

Filesize
4KB

Download
memory/4040-126-0x0000000000405CE2-mapping.dmp

Download
memory/4040-125-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4040-127-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads