warzonerat | e39e81961661f0e514b2bea8f22075ab57cf4fdc12653ecc31fdf8603089c160

General

Target

be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
Size

807KB
MD5

1032e6ffdbb406b3ee80d7c50989e2b5
SHA1

fb63c770ba76d25f181be481acef62aa2cf5f82c
SHA256

be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f
SHA512

bd5203164dd2a966c1db164f6d472615932a673d7be6105c5c36a130e1bb7582e4a9a479833ecbc102c36a5786ef1e459b8eec944beb8cdf51c763078a2923f3

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

185.157.160.215:2211

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2280-127-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2280-128-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/2280-131-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe

description pid process target process

PID 804 set thread context of 2280 804 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe vbc.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

2172 schtasks.exe

description	pid	process	target process
PID 804 set thread context of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe

pid	process
2172	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe

pid	process
804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe

description pid process

Token: SeDebugPrivilege 804 be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe

description	pid	process
Token: SeDebugPrivilege	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe

description	pid	process	target process
PID 804 wrote to memory of 2172	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	schtasks.exe
PID 804 wrote to memory of 2172	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	schtasks.exe
PID 804 wrote to memory of 2172	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	schtasks.exe
PID 804 wrote to memory of 1276	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 1276	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 1276	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 1080	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 1080	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 1080	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe
PID 804 wrote to memory of 2280	804	be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe	vbc.exe

C:\Users\Admin\AppData\Local\Temp\be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe
"C:\Users\Admin\AppData\Local\Temp\be38a69081db308b628205a8d3bf1053120da733b05f38ac497a295723d2b29f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:804

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GrxeqzFZZljX" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD5EE.tmp"
2⤵
- Creates scheduled task(s)
PID:2172

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1276

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:1080

C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
2⤵
PID:2280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Scripting

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpD5EE.tmp

MD5
e497e70b436b095d3620e5e3ecc8d230

SHA1
a32002f7149caddbfe28dc5c110408439e2ce9fd

SHA256
6054e95ae088afb9ae9aa0a43ad56ded9252e157ae014aa8d74375842602152d

SHA512
02dbffa93cd416e24b086f0c44b865f3926e2173162e1ffcbc1e1792a6ab196e115ef2da8959f9cc0cd6d727da891d762a03b74f52c2841ada31b5006c6bc973

Download Submit
memory/804-121-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/804-123-0x000000000CDA0000-0x000000000CE07000-memory.dmp

Filesize
412KB

Download
memory/804-118-0x00000000053B0000-0x00000000053B1000-memory.dmp

Filesize
4KB

Download
memory/804-119-0x0000000005310000-0x000000000580E000-memory.dmp

Filesize
5.0MB

Download
memory/804-120-0x00000000052B0000-0x00000000052B1000-memory.dmp

Filesize
4KB

Download
memory/804-114-0x0000000000940000-0x0000000000941000-memory.dmp

Filesize
4KB

Download
memory/804-122-0x000000000AD30000-0x000000000CD2F000-memory.dmp

Filesize
32.0MB

Download
memory/804-117-0x0000000005810000-0x0000000005811000-memory.dmp

Filesize
4KB

Download
memory/804-124-0x000000000CE10000-0x000000000CE3C000-memory.dmp

Filesize
176KB

Download
memory/804-116-0x0000000005200000-0x0000000005201000-memory.dmp

Filesize
4KB

Download
memory/2172-125-0x0000000000000000-mapping.dmp

Download
memory/2280-127-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2280-128-0x0000000000405CE2-mapping.dmp

Download
memory/2280-131-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads