warzonerat | cbb6e29afb4dd742ae2e834e22a640cf19f31413f2678989fdd7ed5e2ce0d12a

General

Target

f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe
Size

495KB
MD5

3e5de00abc1894db32e6eb3738ca9321
SHA1

6416b26038423c0cf2ffd274f3578b52d359ee2d
SHA256

f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0
SHA512

e1fb5eda0b909563933761d7aa0f21df574e616f9c40bbb08141acae89a04f372709eaf1d85577d5380121ca4cb3ccf7b7bafd23b2cf19f1af156f5df42ab7b6

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

warzonne.publicvm.com:22649

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1008-73-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1008-74-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/1008-84-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

Processes:

RegAsm.exe

pid process

1008 RegAsm.exe
Loads dropped DLL 2 IoCs

Processes:

f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exeRegAsm.exe

pid process

468 f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe
1008 RegAsm.exe

pid	process
1008	RegAsm.exe

pid	process
468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe
1008	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe

description	pid	process	target process
PID 468 set thread context of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exepowershell.exe

pid process

468 f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe
1632 powershell.exe
1632 powershell.exe

pid	process
468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe
1632	powershell.exe
1632	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe
Token: SeDebugPrivilege	1632	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

Processes:

f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exeWScript.exe

description	pid	process	target process
PID 468 wrote to memory of 1520	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	WScript.exe
PID 468 wrote to memory of 1520	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	WScript.exe
PID 468 wrote to memory of 1520	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	WScript.exe
PID 468 wrote to memory of 1520	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	WScript.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 468 wrote to memory of 1008	468	f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe	RegAsm.exe
PID 1520 wrote to memory of 1632	1520	WScript.exe	powershell.exe
PID 1520 wrote to memory of 1632	1520	WScript.exe	powershell.exe
PID 1520 wrote to memory of 1632	1520	WScript.exe	powershell.exe
PID 1520 wrote to memory of 1632	1520	WScript.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe
"C:\Users\Admin\AppData\Local\Temp\f390fd6e97ea6bc9529d434d7e196bae271cff79eaec0cf97afcd26556c0c4f0.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\_Gmbazahvpozveh.vbs"
2⤵
- Suspicious use of WriteProcessMemory
PID:1520

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Set-MpPreference -ExclusionPath C:\,'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\dwrn\explorerr.exe'
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1632

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1008

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\_Gmbazahvpozveh.vbs
MD5
dea2f8a74097b28b02ebe1203cda7dd9

SHA1
ddff48c4ef021b9938b39e45a75344db9c6e3a21

SHA256
a63665a894a0fba12b5771f14e2fa28c49108b0ced2b1c4787d68ebe8651aa73

SHA512
2d28d0a6b993210e07d1bf6add080ed17000eac39173cfc41fb22e1d69c0f0031263dff45330b1940931a03c3da8478e5bdcd8d245a90f2fb7cee6a552d55db3

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
\Users\Admin\AppData\Local\Temp\RegAsm.exe
MD5
b58b926c3574d28d5b7fdd2ca3ec30d5

SHA1
d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

SHA256
6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

SHA512
b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

Download Submit
memory/468-63-0x0000000000D20000-0x0000000000D75000-memory.dmp

Filesize
340KB

Download
memory/468-68-0x0000000005AF0000-0x0000000005B72000-memory.dmp

Filesize
520KB

Download
memory/468-59-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Filesize
4KB

Download
memory/468-62-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/468-61-0x0000000075051000-0x0000000075053000-memory.dmp

Filesize
8KB

Download
memory/1008-73-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1008-74-0x0000000000405CE2-mapping.dmp

Download
memory/1008-84-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1520-69-0x0000000000000000-mapping.dmp

Download
memory/1632-81-0x0000000000C30000-0x0000000000C31000-memory.dmp

Filesize
4KB

Download
memory/1632-90-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/1632-83-0x00000000010A0000-0x00000000010A1000-memory.dmp

Filesize
4KB

Download
memory/1632-79-0x0000000000000000-mapping.dmp

Download
memory/1632-85-0x0000000004C10000-0x0000000004C11000-memory.dmp

Filesize
4KB

Download
memory/1632-86-0x0000000004C12000-0x0000000004C13000-memory.dmp

Filesize
4KB

Download
memory/1632-87-0x00000000027E0000-0x00000000027E1000-memory.dmp

Filesize
4KB

Download
memory/1632-82-0x0000000004C50000-0x0000000004C51000-memory.dmp

Filesize
4KB

Download
memory/1632-95-0x0000000005730000-0x0000000005731000-memory.dmp

Filesize
4KB

Download
memory/1632-96-0x0000000005850000-0x0000000005851000-memory.dmp

Filesize
4KB

Download
memory/1632-103-0x00000000062C0000-0x00000000062C1000-memory.dmp

Filesize
4KB

Download
memory/1632-104-0x0000000006290000-0x0000000006291000-memory.dmp

Filesize
4KB

Download
memory/1632-118-0x0000000006380000-0x0000000006381000-memory.dmp

Filesize
4KB

Download
memory/1632-119-0x0000000006390000-0x0000000006391000-memory.dmp

Filesize
4KB

Download
memory/1632-120-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads