warzonerat | 20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

Analysis

max time kernel
125s
max time network
172s
platform
windows7_x64
resource
win7v20210408
submitted
14-07-2021 07:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6797b19e6f2f174103c00f1fe84b3016.exe
Size

339KB
MD5

6797b19e6f2f174103c00f1fe84b3016
SHA1

86db4e27becc779ddf5769ff861cadf72bca6a1c
SHA256

20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950
SHA512

e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

byx.z86.ru:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Executes dropped EXE 5 IoCs

Processes:

svchost.exesvchost.exesvchost.exesvchost.exesvchost.exe

pid process

1656 svchost.exe
1548 svchost.exe
2020 svchost.exe
1088 svchost.exe
1844 svchost.exe
Loads dropped DLL 5 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exesvchost.exe

pid process

832 6797b19e6f2f174103c00f1fe84b3016.exe
1656 svchost.exe
1656 svchost.exe
1656 svchost.exe
1656 svchost.exe

pid	process
1656	svchost.exe
1548	svchost.exe
2020	svchost.exe
1088	svchost.exe
1844	svchost.exe

pid	process
832	6797b19e6f2f174103c00f1fe84b3016.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exesvchost.exe

description	pid	process	target process
PID 1936 set thread context of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1656 set thread context of 1844	1656	svchost.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exesvchost.exe

pid	process
1936	6797b19e6f2f174103c00f1fe84b3016.exe
1936	6797b19e6f2f174103c00f1fe84b3016.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe
1656	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exesvchost.exe

description pid process

Token: SeDebugPrivilege 1936 6797b19e6f2f174103c00f1fe84b3016.exe
Token: SeDebugPrivilege 1656 svchost.exe

description	pid	process
Token: SeDebugPrivilege	1936	6797b19e6f2f174103c00f1fe84b3016.exe
Token: SeDebugPrivilege	1656	svchost.exe

Suspicious use of WriteProcessMemory 52 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exe6797b19e6f2f174103c00f1fe84b3016.execmd.exesvchost.exesvchost.exe

description	pid	process	target process
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1936 wrote to memory of 832	1936	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 832 wrote to memory of 1644	832	6797b19e6f2f174103c00f1fe84b3016.exe	cmd.exe
PID 832 wrote to memory of 1644	832	6797b19e6f2f174103c00f1fe84b3016.exe	cmd.exe
PID 832 wrote to memory of 1644	832	6797b19e6f2f174103c00f1fe84b3016.exe	cmd.exe
PID 832 wrote to memory of 1644	832	6797b19e6f2f174103c00f1fe84b3016.exe	cmd.exe
PID 832 wrote to memory of 1656	832	6797b19e6f2f174103c00f1fe84b3016.exe	svchost.exe
PID 832 wrote to memory of 1656	832	6797b19e6f2f174103c00f1fe84b3016.exe	svchost.exe
PID 832 wrote to memory of 1656	832	6797b19e6f2f174103c00f1fe84b3016.exe	svchost.exe
PID 832 wrote to memory of 1656	832	6797b19e6f2f174103c00f1fe84b3016.exe	svchost.exe
PID 1644 wrote to memory of 296	1644	cmd.exe	reg.exe
PID 1644 wrote to memory of 296	1644	cmd.exe	reg.exe
PID 1644 wrote to memory of 296	1644	cmd.exe	reg.exe
PID 1644 wrote to memory of 296	1644	cmd.exe	reg.exe
PID 1656 wrote to memory of 1548	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1548	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1548	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1548	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 2020	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 2020	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 2020	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 2020	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1088	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1088	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1088	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1088	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1656 wrote to memory of 1844	1656	svchost.exe	svchost.exe
PID 1844 wrote to memory of 1480	1844	svchost.exe	cmd.exe
PID 1844 wrote to memory of 1480	1844	svchost.exe	cmd.exe
PID 1844 wrote to memory of 1480	1844	svchost.exe	cmd.exe
PID 1844 wrote to memory of 1480	1844	svchost.exe	cmd.exe
PID 1844 wrote to memory of 1480	1844	svchost.exe	cmd.exe
PID 1844 wrote to memory of 1480	1844	svchost.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
"C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936

C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:832

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:1644

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
4⤵
PID:296

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
4⤵
- Executes dropped EXE
PID:1548

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
4⤵
- Executes dropped EXE
PID:2020

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
4⤵
- Executes dropped EXE
PID:1088

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
5⤵
PID:1480

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\ProgramData\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
\ProgramData\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
memory/296-78-0x0000000000000000-mapping.dmp

Download
memory/832-67-0x0000000000405E28-mapping.dmp

Download
memory/832-66-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/832-69-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/832-68-0x0000000075201000-0x0000000075203000-memory.dmp

Filesize
8KB

Download
memory/1480-96-0x0000000000000000-mapping.dmp

Download
memory/1644-70-0x0000000000000000-mapping.dmp

Download
memory/1656-80-0x0000000001295000-0x00000000012A6000-memory.dmp

Filesize
68KB

Download
memory/1656-79-0x0000000001290000-0x0000000001291000-memory.dmp

Filesize
4KB

Download
memory/1656-72-0x0000000000000000-mapping.dmp

Download
memory/1656-75-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/1844-91-0x0000000000405E28-mapping.dmp

Download
memory/1844-94-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1936-65-0x0000000001060000-0x00000000010B9000-memory.dmp

Filesize
356KB

Download
memory/1936-64-0x0000000000AB0000-0x0000000000AF7000-memory.dmp

Filesize
284KB

Download
memory/1936-63-0x0000000004ED5000-0x0000000004EE6000-memory.dmp

Filesize
68KB

Download
memory/1936-62-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

Filesize
4KB

Download
memory/1936-60-0x0000000001140000-0x0000000001141000-memory.dmp

Filesize
4KB

Download