warzonerat | 6f149397c4da5aa8c6278b121a2f8e833fae038a4dab455ee0acbb0f43310294

General

Target

ADING AD,pdf.exe
Size

37KB
MD5

067fd0a4d3ad7323f1e5d73bf944dc84
SHA1

301911757c361e601371e589ace575b4a7bd364b
SHA256

645134b819a6be3f5114946535b7a96c199380c5576c6e65846548ccda530c54
SHA512

1c1f9a88fb91dda4a2e4bb8ccf522c07961e59a220414befff46fe6f175d3f33c0f6474f80208723f1b036b9e8cea6922530acddc0764b4f93a8759a714b6f8b

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

185.157.160.215:2211

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1092-129-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1092-128-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1092-130-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Drops startup file 3 IoCs

Processes:

cmd.exeADING AD,pdf.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe	ADING AD,pdf.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe	cmd.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

ADING AD,pdf.exe

description pid process target process

PID 680 set thread context of 1092 680 ADING AD,pdf.exe ADING AD,pdf.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 680 set thread context of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

Processes:

ADING AD,pdf.exe

pid	process
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe
680	ADING AD,pdf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

ADING AD,pdf.exe

description pid process

Token: SeDebugPrivilege 680 ADING AD,pdf.exe

description	pid	process
Token: SeDebugPrivilege	680	ADING AD,pdf.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

ADING AD,pdf.exe

description	pid	process	target process
PID 680 wrote to memory of 3080	680	ADING AD,pdf.exe	cmd.exe
PID 680 wrote to memory of 3080	680	ADING AD,pdf.exe	cmd.exe
PID 680 wrote to memory of 3080	680	ADING AD,pdf.exe	cmd.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe
PID 680 wrote to memory of 1092	680	ADING AD,pdf.exe	ADING AD,pdf.exe

C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c Copy "C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe"
2⤵
- Drops startup file
PID:3080

C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\ADING AD,pdf.exe"
2⤵
PID:1092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ADING AD,pdf.exe

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/680-123-0x00000000062A0000-0x00000000062A1000-memory.dmp

Filesize
4KB

Download
memory/680-116-0x0000000005220000-0x0000000005221000-memory.dmp

Filesize
4KB

Download
memory/680-118-0x0000000004DC0000-0x0000000004DC1000-memory.dmp

Filesize
4KB

Download
memory/680-119-0x0000000005DE0000-0x0000000005E13000-memory.dmp

Filesize
204KB

Download
memory/680-120-0x0000000005F30000-0x0000000005F31000-memory.dmp

Filesize
4KB

Download
memory/680-121-0x0000000004D20000-0x000000000521E000-memory.dmp

Filesize
5.0MB

Download
memory/680-117-0x0000000004D20000-0x0000000004D21000-memory.dmp

Filesize
4KB

Download
memory/680-127-0x0000000006200000-0x000000000629C000-memory.dmp

Filesize
624KB

Download
memory/680-122-0x0000000005F90000-0x0000000005F91000-memory.dmp

Filesize
4KB

Download
memory/680-125-0x0000000006730000-0x0000000006731000-memory.dmp

Filesize
4KB

Download
memory/680-114-0x0000000000490000-0x0000000000491000-memory.dmp

Filesize
4KB

Download
memory/1092-129-0x0000000000405CE2-mapping.dmp

Download
memory/1092-128-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1092-130-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3080-124-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads