warzonerat | 8defe9e761e45c1d2b7d8aecd4073068f2026d20eff14d247028618bc7e6ed73

General

Target
1edf6239fdc16549861e1b187c396ce2.exe
Size 392KB
Sample210818-5fn3evtx4j
SHA256 8defe9e761e45c1d2b7d8aecd4073068f2026d20eff14d247028618bc7e6ed73
MD5 1edf6239fdc16549861e1b187c396ce2
SHA1 19601baf18c899231b25164d5416e8f10da1f2c3
SHA512 9c61b20702a26c0a6c27084267a0cc2ef05e80bd768f79e113022a74c2f024f8460f0854935a305b8718221a6f2ed8e1af3b8a8b80e4d35e2b896efca38dfa4a
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

oklahamaa.ydns.eu:4150

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\dlcoer.dll	1edf6239fdc16549861e1b187c396ce2.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 740 set thread context of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\symsrv.dll	1edf6239fdc16549861e1b187c396ce2.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3424	1924	WerFault.exe	78

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
740	1edf6239fdc16549861e1b187c396ce2.exe
740	1edf6239fdc16549861e1b187c396ce2.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe
3424	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	740	1edf6239fdc16549861e1b187c396ce2.exe
Token: SeRestorePrivilege	3424	WerFault.exe
Token: SeBackupPrivilege	3424	WerFault.exe
Token: SeDebugPrivilege	3424	WerFault.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78
PID 740 wrote to memory of 1924	740	1edf6239fdc16549861e1b187c396ce2.exe	78

C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe
"C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:740
- C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe
  C:\Users\Admin\AppData\Local\Temp\1edf6239fdc16549861e1b187c396ce2.exe
  2⤵
  - Drops file in System32 directory
  - Drops file in Program Files directory
  PID:1924
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1924 -s 540
    3⤵
    - Program crash
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3424

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/740-114-0x00000000008E0000-0x00000000008E1000-memory.dmp

Download

memory/740-116-0x0000000005620000-0x0000000005621000-memory.dmp

Download

memory/740-117-0x00000000051C0000-0x00000000051C1000-memory.dmp

Download

memory/740-118-0x0000000005120000-0x000000000561E000-memory.dmp

Download

memory/740-119-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/740-120-0x0000000006BC0000-0x0000000006C20000-memory.dmp

Download

memory/740-121-0x0000000006E20000-0x0000000006E21000-memory.dmp

Download

memory/740-126-0x0000000007DF0000-0x0000000007E59000-memory.dmp

Download

memory/740-127-0x0000000007F10000-0x0000000007F11000-memory.dmp

Download

memory/1924-128-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1924-130-0x0000000000400000-0x000000000055E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads