warzonerat | 8defe9e761e45c1d2b7d8aecd4073068f2026d20eff14d247028618bc7e6ed73

General

Target
1edf6239fdc16549861e1b187c396ce2.exe
Size 392KB
Sample210818-5fn3evtx4j
SHA256 8defe9e761e45c1d2b7d8aecd4073068f2026d20eff14d247028618bc7e6ed73
MD5 1edf6239fdc16549861e1b187c396ce2
SHA1 19601baf18c899231b25164d5416e8f10da1f2c3
SHA512 9c61b20702a26c0a6c27084267a0cc2ef05e80bd768f79e113022a74c2f024f8460f0854935a305b8718221a6f2ed8e1af3b8a8b80e4d35e2b896efca38dfa4a
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

oklahamaa.ydns.eu:4150

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dlcoer.dll	1edf6239fdc16549861e1b187c396ce2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1640 set thread context of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	1edf6239fdc16549861e1b187c396ce2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
268	672	WerFault.exe	29

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1640	1edf6239fdc16549861e1b187c396ce2.exe
1640	1edf6239fdc16549861e1b187c396ce2.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe
268	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
268	WerFault.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	1edf6239fdc16549861e1b187c396ce2.exe
Token: SeDebugPrivilege	268	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 1640 wrote to memory of 672	1640	1edf6239fdc16549861e1b187c396ce2.exe	29
PID 672 wrote to memory of 268	672	1edf6239fdc16549861e1b187c396ce2.exe	30
PID 672 wrote to memory of 268	672	1edf6239fdc16549861e1b187c396ce2.exe	30
PID 672 wrote to memory of 268	672	1edf6239fdc16549861e1b187c396ce2.exe	30
PID 672 wrote to memory of 268	672	1edf6239fdc16549861e1b187c396ce2.exe	30

C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe
"C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe
  C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 672 -s 200
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: GetForegroundWindowSpam
    - Suspicious use of AdjustPrivilegeToken
    PID:268

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-74-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/672-69-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/672-71-0x0000000075411000-0x0000000075413000-memory.dmp

Download

memory/672-73-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1640-60-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/1640-62-0x0000000000A90000-0x0000000000A91000-memory.dmp

Download

memory/1640-63-0x0000000000A30000-0x0000000000A90000-memory.dmp

Download

memory/1640-68-0x0000000007E70000-0x0000000007ED9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads