warzonerat | 6f149397c4da5aa8c6278b121a2f8e833fae038a4dab455ee0acbb0f43310294

General

Target

ADING AD,pdf.exe
Size

37KB
MD5

067fd0a4d3ad7323f1e5d73bf944dc84
SHA1

301911757c361e601371e589ace575b4a7bd364b
SHA256

645134b819a6be3f5114946535b7a96c199380c5576c6e65846548ccda530c54
SHA512

1c1f9a88fb91dda4a2e4bb8ccf522c07961e59a220414befff46fe6f175d3f33c0f6474f80208723f1b036b9e8cea6922530acddc0764b4f93a8759a714b6f8b

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

185.157.160.215:2211

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/8-128-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/8-129-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/8-130-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Drops startup file 3 IoCs

Processes:

cmd.exeADING AD,pdf.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe	ADING AD,pdf.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ADING AD,pdf.exe

description pid process target process

PID 2016 set thread context of 8 2016 ADING AD,pdf.exe ADING AD,pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 2016 set thread context of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe

Suspicious behavior: EnumeratesProcesses 47 IoCs

Processes:

ADING AD,pdf.exe

pid	process
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe
2016	ADING AD,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ADING AD,pdf.exe

description pid process

Token: SeDebugPrivilege 2016 ADING AD,pdf.exe

description	pid	process
Token: SeDebugPrivilege	2016	ADING AD,pdf.exe

Suspicious use of WriteProcessMemory 17 IoCs

Processes:

ADING AD,pdf.exe

description	pid	process	target process
PID 2016 wrote to memory of 2240	2016	ADING AD,pdf.exe	cmd.exe
PID 2016 wrote to memory of 2240	2016	ADING AD,pdf.exe	cmd.exe
PID 2016 wrote to memory of 2240	2016	ADING AD,pdf.exe	cmd.exe
PID 2016 wrote to memory of 3296	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 3296	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 3296	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 2016 wrote to memory of 8	2016	ADING AD,pdf.exe	ADING AD,pdf.exe

C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe"
2⤵
- Drops startup file
PID:2240

C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe"
2⤵
PID:3296

C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe"
2⤵
PID:8

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe

MD5
067fd0a4d3ad7323f1e5d73bf944dc84

SHA1
301911757c361e601371e589ace575b4a7bd364b

SHA256
645134b819a6be3f5114946535b7a96c199380c5576c6e65846548ccda530c54

SHA512
1c1f9a88fb91dda4a2e4bb8ccf522c07961e59a220414befff46fe6f175d3f33c0f6474f80208723f1b036b9e8cea6922530acddc0764b4f93a8759a714b6f8b

Download Submit
memory/8-130-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/8-129-0x0000000000405CE2-mapping.dmp

Download
memory/8-128-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2016-123-0x0000000005F60000-0x0000000005F61000-memory.dmp

Filesize
4KB

Download
memory/2016-120-0x0000000004AB0000-0x0000000004FAE000-memory.dmp

Filesize
5.0MB

Download
memory/2016-121-0x0000000005BC0000-0x0000000005BC1000-memory.dmp

Filesize
4KB

Download
memory/2016-122-0x0000000005C20000-0x0000000005C21000-memory.dmp

Filesize
4KB

Download
memory/2016-114-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2016-125-0x0000000006070000-0x0000000006071000-memory.dmp

Filesize
4KB

Download
memory/2016-119-0x0000000005AB0000-0x0000000005AE3000-memory.dmp

Filesize
204KB

Download
memory/2016-127-0x0000000005EC0000-0x0000000005F5C000-memory.dmp

Filesize
624KB

Download
memory/2016-118-0x0000000004AB0000-0x0000000004AB1000-memory.dmp

Filesize
4KB

Download
memory/2016-117-0x00000000049F0000-0x00000000049F1000-memory.dmp

Filesize
4KB

Download
memory/2016-116-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

Filesize
4KB

Download
memory/2240-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads