warzonerat | 0dbfba707732ce89b9302ac1705605b22204e3bb6894c7714a1d080e05edf26b

General

Target

Bank Millennium S.A.bin.exe
Size

37KB
MD5

067fd0a4d3ad7323f1e5d73bf944dc84
SHA1

301911757c361e601371e589ace575b4a7bd364b
SHA256

645134b819a6be3f5114946535b7a96c199380c5576c6e65846548ccda530c54
SHA512

1c1f9a88fb91dda4a2e4bb8ccf522c07961e59a220414befff46fe6f175d3f33c0f6474f80208723f1b036b9e8cea6922530acddc0764b4f93a8759a714b6f8b

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

185.157.160.215:2211

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1264-129-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1264-128-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1264-130-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Drops startup file 3 IoCs

Processes:

cmd.exeBank Millennium S.A.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bank Millennium S.A.bin.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bank Millennium S.A.bin.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Bank Millennium S.A.bin.exe

description pid process target process

PID 4060 set thread context of 1264 4060 Bank Millennium S.A.bin.exe Bank Millennium S.A.bin.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4060 set thread context of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

Bank Millennium S.A.bin.exe

pid	process
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe
4060	Bank Millennium S.A.bin.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

Bank Millennium S.A.bin.exe

description pid process

Token: SeDebugPrivilege 4060 Bank Millennium S.A.bin.exe

description	pid	process
Token: SeDebugPrivilege	4060	Bank Millennium S.A.bin.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

Bank Millennium S.A.bin.exe

description	pid	process	target process
PID 4060 wrote to memory of 3604	4060	Bank Millennium S.A.bin.exe	cmd.exe
PID 4060 wrote to memory of 3604	4060	Bank Millennium S.A.bin.exe	cmd.exe
PID 4060 wrote to memory of 3604	4060	Bank Millennium S.A.bin.exe	cmd.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe
PID 4060 wrote to memory of 1264	4060	Bank Millennium S.A.bin.exe	Bank Millennium S.A.bin.exe

C:\Users\Admin\AppData\Local\Temp\Bank Millennium S.A.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Millennium S.A.bin.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4060

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\Bank Millennium S.A.bin.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bank Millennium S.A.bin.exe"
2⤵
- Drops startup file
PID:3604

C:\Users\Admin\AppData\Local\Temp\Bank Millennium S.A.bin.exe
"C:\Users\Admin\AppData\Local\Temp\Bank Millennium S.A.bin.exe"
2⤵
PID:1264

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bank Millennium S.A.bin.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/1264-130-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1264-128-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1264-129-0x0000000000405CE2-mapping.dmp

Download
memory/3604-124-0x0000000000000000-mapping.dmp

Download
memory/4060-123-0x00000000060F0000-0x00000000060F1000-memory.dmp

Filesize
4KB

Download
memory/4060-121-0x0000000005030000-0x0000000005031000-memory.dmp

Filesize
4KB

Download
memory/4060-122-0x0000000005DF0000-0x0000000005DF1000-memory.dmp

Filesize
4KB

Download
memory/4060-114-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/4060-120-0x0000000004B50000-0x000000000504E000-memory.dmp

Filesize
5.0MB

Download
memory/4060-125-0x0000000006580000-0x0000000006581000-memory.dmp

Filesize
4KB

Download
memory/4060-119-0x0000000005C90000-0x0000000005CC3000-memory.dmp

Filesize
204KB

Download
memory/4060-127-0x0000000006050000-0x00000000060EC000-memory.dmp

Filesize
624KB

Download
memory/4060-118-0x0000000004C90000-0x0000000004C91000-memory.dmp

Filesize
4KB

Download
memory/4060-117-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

Filesize
4KB

Download
memory/4060-116-0x0000000005050000-0x0000000005051000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads