warzonerat | 0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87

Analysis

max time kernel
125s
max time network
149s
platform
windows10_x64
resource
win10v20210410
submitted
27/07/2021, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
391c3bc7f5534306976f645db21ff085.exe
Size 473KB
Sample210727-zy711adele
SHA256 0618cbdf54ff6529c1e7b1c97242d8e9ec85cf8a4bb29cc3244743d200479a87
MD5 391c3bc7f5534306976f645db21ff085
SHA1 4b20940c605a93eef2de9853a180431165e7e16d
SHA512 762f8369307823f94d3fce0c8b76bbeaeb44841cb8a0a442db2586485a24ae5821c2d9136f24ab28a04df93bdf42f8c8745fe502dc990cbb04b759b4640dfaee
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

ghjklhgteg.strangled.net:6703

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 2 IoCs

pid	Process
3280	images.exe
3936	images.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3540 set thread context of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3280 set thread context of 3936	3280	images.exe	80

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3540	391c3bc7f5534306976f645db21ff085.exe
3540	391c3bc7f5534306976f645db21ff085.exe
3280	images.exe
3280	images.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3540	391c3bc7f5534306976f645db21ff085.exe
Token: SeDebugPrivilege	3280	images.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 3540 wrote to memory of 2192	3540	391c3bc7f5534306976f645db21ff085.exe	78
PID 2192 wrote to memory of 3280	2192	391c3bc7f5534306976f645db21ff085.exe	79
PID 2192 wrote to memory of 3280	2192	391c3bc7f5534306976f645db21ff085.exe	79
PID 2192 wrote to memory of 3280	2192	391c3bc7f5534306976f645db21ff085.exe	79
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3280 wrote to memory of 3936	3280	images.exe	80
PID 3936 wrote to memory of 496	3936	images.exe	81
PID 3936 wrote to memory of 496	3936	images.exe	81
PID 3936 wrote to memory of 496	3936	images.exe	81
PID 3936 wrote to memory of 496	3936	images.exe	81
PID 3936 wrote to memory of 496	3936	images.exe	81

C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe
"C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3540
- C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe
  C:\Users\Admin\AppData\Local\Temp\391c3bc7f5534306976f645db21ff085.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\images.exe
      C:\Users\Admin\AppData\Local\Temp\images.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3936
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:496

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/496-156-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/2192-129-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/2192-131-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/3280-142-0x0000000004920000-0x0000000004E1E000-memory.dmp

Download

memory/3280-141-0x0000000004920000-0x0000000004E1E000-memory.dmp

Download

memory/3280-143-0x0000000004920000-0x0000000004E1E000-memory.dmp

Download

memory/3280-140-0x0000000004920000-0x0000000004E1E000-memory.dmp

Download

memory/3540-114-0x0000000000F60000-0x0000000000F61000-memory.dmp

Download

memory/3540-119-0x0000000005760000-0x00000000057F2000-memory.dmp

Download

memory/3540-122-0x00000000057F4000-0x00000000057F5000-memory.dmp

Download

memory/3540-121-0x00000000057F2000-0x00000000057F4000-memory.dmp

Download

memory/3540-128-0x0000000009280000-0x00000000092F3000-memory.dmp

Download

memory/3540-123-0x0000000007440000-0x0000000007492000-memory.dmp

Download

memory/3540-120-0x0000000005760000-0x00000000057F2000-memory.dmp

Download

memory/3540-118-0x00000000058B0000-0x00000000058B1000-memory.dmp

Download

memory/3540-117-0x0000000005800000-0x0000000005801000-memory.dmp

Download

memory/3540-116-0x0000000005E20000-0x0000000005E21000-memory.dmp

Download

memory/3936-154-0x0000000000400000-0x000000000055E000-memory.dmp

Download