warzonerat | 20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

General

Target

6797b19e6f2f174103c00f1fe84b3016.exe
Size

339KB
MD5

6797b19e6f2f174103c00f1fe84b3016
SHA1

86db4e27becc779ddf5769ff861cadf72bca6a1c
SHA256

20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950
SHA512

e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

byx.z86.ru:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Executes dropped EXE 2 IoCs

Processes:

svchost.exesvchost.exe

pid process

2936 svchost.exe
3152 svchost.exe

pid	process
2936	svchost.exe
3152	svchost.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exesvchost.exe

description	pid	process	target process
PID 3164 set thread context of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 2936 set thread context of 3152	2936	svchost.exe	svchost.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exesvchost.exe

pid	process
3164	6797b19e6f2f174103c00f1fe84b3016.exe
3164	6797b19e6f2f174103c00f1fe84b3016.exe
3164	6797b19e6f2f174103c00f1fe84b3016.exe
3164	6797b19e6f2f174103c00f1fe84b3016.exe
3164	6797b19e6f2f174103c00f1fe84b3016.exe
3164	6797b19e6f2f174103c00f1fe84b3016.exe
2936	svchost.exe
2936	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exesvchost.exe

description pid process

Token: SeDebugPrivilege 3164 6797b19e6f2f174103c00f1fe84b3016.exe
Token: SeDebugPrivilege 2936 svchost.exe

description	pid	process
Token: SeDebugPrivilege	3164	6797b19e6f2f174103c00f1fe84b3016.exe
Token: SeDebugPrivilege	2936	svchost.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

6797b19e6f2f174103c00f1fe84b3016.exe6797b19e6f2f174103c00f1fe84b3016.execmd.exesvchost.exesvchost.exe

description	pid	process	target process
PID 3164 wrote to memory of 3968	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 3968	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 3968	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 3164 wrote to memory of 1276	3164	6797b19e6f2f174103c00f1fe84b3016.exe	6797b19e6f2f174103c00f1fe84b3016.exe
PID 1276 wrote to memory of 2104	1276	6797b19e6f2f174103c00f1fe84b3016.exe	cmd.exe
PID 1276 wrote to memory of 2104	1276	6797b19e6f2f174103c00f1fe84b3016.exe	cmd.exe
PID 1276 wrote to memory of 2104	1276	6797b19e6f2f174103c00f1fe84b3016.exe	cmd.exe
PID 1276 wrote to memory of 2936	1276	6797b19e6f2f174103c00f1fe84b3016.exe	svchost.exe
PID 1276 wrote to memory of 2936	1276	6797b19e6f2f174103c00f1fe84b3016.exe	svchost.exe
PID 1276 wrote to memory of 2936	1276	6797b19e6f2f174103c00f1fe84b3016.exe	svchost.exe
PID 2104 wrote to memory of 1128	2104	cmd.exe	reg.exe
PID 2104 wrote to memory of 1128	2104	cmd.exe	reg.exe
PID 2104 wrote to memory of 1128	2104	cmd.exe	reg.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 2936 wrote to memory of 3152	2936	svchost.exe	svchost.exe
PID 3152 wrote to memory of 3980	3152	svchost.exe	cmd.exe
PID 3152 wrote to memory of 3980	3152	svchost.exe	cmd.exe
PID 3152 wrote to memory of 3980	3152	svchost.exe	cmd.exe
PID 3152 wrote to memory of 3980	3152	svchost.exe	cmd.exe
PID 3152 wrote to memory of 3980	3152	svchost.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
"C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3164

C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
2⤵
PID:3968

C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
C:\Users\Admin\AppData\Local\Temp\6797b19e6f2f174103c00f1fe84b3016.exe
2⤵
- Suspicious use of WriteProcessMemory
PID:1276

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:2104

C:\Windows\SysWOW64\reg.exe
REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\svchost.exe"
4⤵
PID:1128

C:\ProgramData\svchost.exe
"C:\ProgramData\svchost.exe"
3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936

C:\Users\Admin\AppData\Local\Temp\svchost.exe
C:\Users\Admin\AppData\Local\Temp\svchost.exe
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3152

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
5⤵
PID:3980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\ProgramData\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe
MD5
6797b19e6f2f174103c00f1fe84b3016

SHA1
86db4e27becc779ddf5769ff861cadf72bca6a1c

SHA256
20abe25c4f02f73cdda3e8e74187202fbdbf5fa2fd7fe92b2d1ab328b66c1950

SHA512
e157b38cbecf4dc46e1f2d0d350bae90410057f981d5f428f4c50440efaa962484ad8448576159ea505cf0fc5c602c63d66e2c8b4a2bba6b3cb4e4c980e2f711

Download Submit
memory/1128-136-0x0000000000000000-mapping.dmp

Download
memory/1276-125-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1276-127-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1276-126-0x0000000000405E28-mapping.dmp

Download
memory/2104-128-0x0000000000000000-mapping.dmp

Download
memory/2936-138-0x0000000005300000-0x00000000057FE000-memory.dmp

Filesize
5.0MB

Download
memory/2936-129-0x0000000000000000-mapping.dmp

Download
memory/2936-139-0x0000000005300000-0x00000000057FE000-memory.dmp

Filesize
5.0MB

Download
memory/3152-148-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/3152-145-0x0000000000405E28-mapping.dmp

Download
memory/3164-121-0x0000000006A10000-0x0000000006A57000-memory.dmp

Filesize
284KB

Download
memory/3164-120-0x0000000004FF3000-0x0000000004FF5000-memory.dmp

Filesize
8KB

Download
memory/3164-119-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

Filesize
4KB

Download
memory/3164-118-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/3164-114-0x0000000000760000-0x0000000000761000-memory.dmp

Filesize
4KB

Download
memory/3164-124-0x00000000074A0000-0x00000000074A1000-memory.dmp

Filesize
4KB

Download
memory/3164-122-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

Filesize
4KB

Download
memory/3164-117-0x0000000005010000-0x0000000005011000-memory.dmp

Filesize
4KB

Download
memory/3164-116-0x0000000005510000-0x0000000005511000-memory.dmp

Filesize
4KB

Download
memory/3164-123-0x0000000006A60000-0x0000000006AB9000-memory.dmp

Filesize
356KB

Download
memory/3980-149-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads