warzonerat | 0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87

Analysis

max time kernel
133s
max time network
174s
platform
windows7_x64
resource
win7v20210408
submitted
27/07/2021, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
391c3bc7f5534306976f645db21ff085.exe
Size 473KB
Sample210727-zy711adele
SHA256 0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
MD5 391c3bc7f5534306976f645db21ff085
SHA1 4b20940c605a93eef2de9853a180431165e7e16d
SHA512 762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

ghjklhgteg.strangled.net:6703

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 2 IoCs

pid	Process
1476	images.exe
1500	images.exe

Loads dropped DLL 2 IoCs

pid	Process
1172	391c3bc7f5534306976f645db21ff085.exe
1476	images.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1652 set thread context of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1476 set thread context of 1500	1476	images.exe	31

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1652	391c3bc7f5534306976f645db21ff085.exe
1652	391c3bc7f5534306976f645db21ff085.exe
1476	images.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1652	391c3bc7f5534306976f645db21ff085.exe
Token: SeDebugPrivilege	1476	images.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1652 wrote to memory of 1172	1652	391c3bc7f5534306976f645db21ff085.exe	29
PID 1172 wrote to memory of 1476	1172	391c3bc7f5534306976f645db21ff085.exe	30
PID 1172 wrote to memory of 1476	1172	391c3bc7f5534306976f645db21ff085.exe	30
PID 1172 wrote to memory of 1476	1172	391c3bc7f5534306976f645db21ff085.exe	30
PID 1172 wrote to memory of 1476	1172	391c3bc7f5534306976f645db21ff085.exe	30
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1476 wrote to memory of 1500	1476	images.exe	31
PID 1500 wrote to memory of 904	1500	images.exe	32
PID 1500 wrote to memory of 904	1500	images.exe	32
PID 1500 wrote to memory of 904	1500	images.exe	32
PID 1500 wrote to memory of 904	1500	images.exe	32
PID 1500 wrote to memory of 904	1500	images.exe	32
PID 1500 wrote to memory of 904	1500	images.exe	32

C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe
"C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe
  C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1476
  - - C:\Users\Admin\AppData\Local\Temp\images.exe
      C:\Users\Admin\AppData\Local\Temp\images.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1500
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:904

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/904-98-0x00000000000B0000-0x00000000000B1000-memory.dmp

Download

memory/1172-74-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1172-71-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1172-73-0x0000000076641000-0x0000000076643000-memory.dmp

Download

memory/1476-79-0x0000000000120000-0x0000000000121000-memory.dmp

Download

memory/1476-82-0x0000000000701000-0x0000000000702000-memory.dmp

Download

memory/1476-81-0x0000000000700000-0x0000000000701000-memory.dmp

Download

memory/1476-83-0x0000000000706000-0x0000000000717000-memory.dmp

Download

memory/1500-95-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1652-70-0x00000000080A0000-0x0000000008113000-memory.dmp

Download

memory/1652-63-0x0000000004DD1000-0x0000000004DD2000-memory.dmp

Download

memory/1652-60-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/1652-62-0x0000000004DD0000-0x0000000004DD1000-memory.dmp

Download

memory/1652-64-0x0000000004DD6000-0x0000000004DE7000-memory.dmp

Download

memory/1652-65-0x0000000001000000-0x0000000001052000-memory.dmp

Download