warzonerat | 39fb1a47b9dd909768be83b9e05f2c883dc20f43397cc5bfa772268a1c61bd5d

General

Target

new.bin.exe
Size

1.6MB
MD5

40e3805e5cad44b618fd0656ec933c9c
SHA1

ae638966794b68432c4fcc78acc0ac3375f9a842
SHA256

7dd1dba508f4b74d50a22f41f0efe3ff4bc30339e9eef45d390d32de2aa2ca2b
SHA512

97c8388ccdc0af8945c241133cfb0953359ccbc476e516bd555fa94f0f4348dc27832af4ab8334f9559caeda0c090edd6596e7b9ee0fcd5aefb89721bc7257ef

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

23.82.140.14:433

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1096-114-0x00000000017B0000-0x00000000023B0000-memory.dmp	warzonerat
behavioral2/memory/1096-115-0x0000000001610000-0x0000000001764000-memory.dmp	warzonerat
behavioral2/memory/1200-234-0x0000000001B80000-0x0000000001CD4000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

Processes:

winhost.exe

pid process

1200 winhost.exe

pid	process
1200	winhost.exe

Drops startup file 2 IoCs

Processes:

new.bin.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	new.bin.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	new.bin.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

new.bin.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\winhost = "C:\\ProgramData\\winhost.exe"	new.bin.exe

NTFS ADS 1 IoCs

Processes:

new.bin.exe

description ioc process

File created C:\ProgramData:ApplicationData new.bin.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

powershell.exepowershell.exe

pid process

1536 powershell.exe
1536 powershell.exe
1536 powershell.exe
680 powershell.exe
680 powershell.exe
680 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1536 powershell.exe
Token: SeDebugPrivilege 680 powershell.exe

description	ioc	process
File created	C:\ProgramData:ApplicationData	new.bin.exe

pid	process
1536	powershell.exe
1536	powershell.exe
1536	powershell.exe
680	powershell.exe
680	powershell.exe
680	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1536	powershell.exe
Token: SeDebugPrivilege	680	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

new.bin.exewinhost.exe

description	pid	process	target process
PID 1096 wrote to memory of 1536	1096	new.bin.exe	powershell.exe
PID 1096 wrote to memory of 1536	1096	new.bin.exe	powershell.exe
PID 1096 wrote to memory of 1536	1096	new.bin.exe	powershell.exe
PID 1096 wrote to memory of 1200	1096	new.bin.exe	winhost.exe
PID 1096 wrote to memory of 1200	1096	new.bin.exe	winhost.exe
PID 1096 wrote to memory of 1200	1096	new.bin.exe	winhost.exe
PID 1200 wrote to memory of 680	1200	winhost.exe	powershell.exe
PID 1200 wrote to memory of 680	1200	winhost.exe	powershell.exe
PID 1200 wrote to memory of 680	1200	winhost.exe	powershell.exe
PID 1200 wrote to memory of 3856	1200	winhost.exe	cmd.exe
PID 1200 wrote to memory of 3856	1200	winhost.exe	cmd.exe
PID 1200 wrote to memory of 3856	1200	winhost.exe	cmd.exe
PID 1200 wrote to memory of 3856	1200	winhost.exe	cmd.exe
PID 1200 wrote to memory of 3856	1200	winhost.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\new.bin.exe
"C:\Users\Admin\AppData\Local\Temp\new.bin.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1096

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1536

C:\ProgramData\winhost.exe
"C:\ProgramData\winhost.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:3856

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\winhost.exe
MD5
40e3805e5cad44b618fd0656ec933c9c

SHA1
ae638966794b68432c4fcc78acc0ac3375f9a842

SHA256
7dd1dba508f4b74d50a22f41f0efe3ff4bc30339e9eef45d390d32de2aa2ca2b

SHA512
97c8388ccdc0af8945c241133cfb0953359ccbc476e516bd555fa94f0f4348dc27832af4ab8334f9559caeda0c090edd6596e7b9ee0fcd5aefb89721bc7257ef

Download Submit
C:\ProgramData\winhost.exe
MD5
40e3805e5cad44b618fd0656ec933c9c

SHA1
ae638966794b68432c4fcc78acc0ac3375f9a842

SHA256
7dd1dba508f4b74d50a22f41f0efe3ff4bc30339e9eef45d390d32de2aa2ca2b

SHA512
97c8388ccdc0af8945c241133cfb0953359ccbc476e516bd555fa94f0f4348dc27832af4ab8334f9559caeda0c090edd6596e7b9ee0fcd5aefb89721bc7257ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5
1c19c16e21c97ed42d5beabc93391fc5

SHA1
8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

SHA256
1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

SHA512
7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5
05c8cfcaf93c10aa8d2a0eff44ff453c

SHA1
75a37b34478ab0eff34ab03841f63207e51a3bac

SHA256
700178176e1fb7956e343e49c042c9ceaad5a2c9c0630fbbbe4ef1092fb860b7

SHA512
2b51efa8146b1e1c750c5a9001f63f4e52e8417777008b49c022f8f679264c351a043496ae34745e69f7b08575255a180b71f4d3110418a006274d757ee5b2cc

Download Submit
memory/680-391-0x00000000040B2000-0x00000000040B3000-memory.dmp

Filesize
4KB

Download
memory/680-484-0x00000000040B3000-0x00000000040B4000-memory.dmp

Filesize
4KB

Download
memory/680-483-0x000000007E570000-0x000000007E571000-memory.dmp

Filesize
4KB

Download
memory/680-390-0x00000000040B0000-0x00000000040B1000-memory.dmp

Filesize
4KB

Download
memory/680-373-0x0000000000000000-mapping.dmp

Download
memory/1096-115-0x0000000001610000-0x0000000001764000-memory.dmp

Filesize
1.3MB

Download
memory/1096-114-0x00000000017B0000-0x00000000023B0000-memory.dmp

Filesize
12.0MB

Download
memory/1200-121-0x0000000000000000-mapping.dmp

Download
memory/1200-234-0x0000000001B80000-0x0000000001CD4000-memory.dmp

Filesize
1.3MB

Download
memory/1536-136-0x00000000089D0000-0x00000000089D1000-memory.dmp

Filesize
4KB

Download
memory/1536-357-0x0000000009B90000-0x0000000009B91000-memory.dmp

Filesize
4KB

Download
memory/1536-135-0x00000000088B0000-0x00000000088B1000-memory.dmp

Filesize
4KB

Download
memory/1536-133-0x00000000081F0000-0x00000000081F1000-memory.dmp

Filesize
4KB

Download
memory/1536-144-0x0000000009730000-0x0000000009763000-memory.dmp

Filesize
204KB

Download
memory/1536-151-0x0000000009710000-0x0000000009711000-memory.dmp

Filesize
4KB

Download
memory/1536-157-0x00000000098C0000-0x00000000098C1000-memory.dmp

Filesize
4KB

Download
memory/1536-156-0x000000007E710000-0x000000007E711000-memory.dmp

Filesize
4KB

Download
memory/1536-158-0x0000000009CB0000-0x0000000009CB1000-memory.dmp

Filesize
4KB

Download
memory/1536-166-0x0000000004F43000-0x0000000004F44000-memory.dmp

Filesize
4KB

Download
memory/1536-132-0x0000000008180000-0x0000000008181000-memory.dmp

Filesize
4KB

Download
memory/1536-134-0x0000000008680000-0x0000000008681000-memory.dmp

Filesize
4KB

Download
memory/1536-363-0x0000000008AC0000-0x0000000008AC1000-memory.dmp

Filesize
4KB

Download
memory/1536-131-0x0000000007FA0000-0x0000000007FA1000-memory.dmp

Filesize
4KB

Download
memory/1536-120-0x0000000000000000-mapping.dmp

Download
memory/1536-130-0x00000000078D0000-0x00000000078D1000-memory.dmp

Filesize
4KB

Download
memory/1536-129-0x0000000004F42000-0x0000000004F43000-memory.dmp

Filesize
4KB

Download
memory/1536-126-0x0000000004E70000-0x0000000004E71000-memory.dmp

Filesize
4KB

Download
memory/1536-128-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download
memory/1536-127-0x0000000007970000-0x0000000007971000-memory.dmp

Filesize
4KB

Download
memory/3856-395-0x0000000000510000-0x0000000000511000-memory.dmp

Filesize
4KB

Download
memory/3856-374-0x0000000000000000-mapping.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads