warzonerat | fea29fb2293dfa888c3ce64dba2e775b2793b7f2edd4bd647dd5d2a96d1bdc04

Analysis

max time kernel
154s
max time network
171s
platform
windows10_x64
resource
win10v20210408
submitted
26/08/2021, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68a40e341f28507ebd504564fc8507d3.exe
Size 338KB
Sample210826-4m4zwlwvas
SHA256 fea29fb2293dfa888c3ce64dba2e775b2793b7f2edd4bd647dd5d2a96d1bdc04
MD5 68a40e341f28507ebd504564fc8507d3
SHA1 aa837e7e44baa5d13be6fb5530454429a4c24e75
SHA512 115f8f59f575e4630b43774f2757746a1860e4d72f28650f19d809479e2126e95414efa6e983991b29bed61e8b1e108fbb77a1426e1d1db447125764cdc443c9
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

sdafsdffssffs.ydns.eu:6703

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 2 IoCs

pid	Process
2844	images.exe
4020	images.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 2844 set thread context of 4020	2844	images.exe	83

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
900	68a40e341f28507ebd504564fc8507d3.exe
900	68a40e341f28507ebd504564fc8507d3.exe
2844	images.exe
2844	images.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	900	68a40e341f28507ebd504564fc8507d3.exe
Token: SeDebugPrivilege	2844	images.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 900 wrote to memory of 2388	900	68a40e341f28507ebd504564fc8507d3.exe	78
PID 2388 wrote to memory of 2224	2388	68a40e341f28507ebd504564fc8507d3.exe	79
PID 2388 wrote to memory of 2224	2388	68a40e341f28507ebd504564fc8507d3.exe	79
PID 2388 wrote to memory of 2224	2388	68a40e341f28507ebd504564fc8507d3.exe	79
PID 2388 wrote to memory of 2844	2388	68a40e341f28507ebd504564fc8507d3.exe	81
PID 2388 wrote to memory of 2844	2388	68a40e341f28507ebd504564fc8507d3.exe	81
PID 2388 wrote to memory of 2844	2388	68a40e341f28507ebd504564fc8507d3.exe	81
PID 2224 wrote to memory of 1040	2224	cmd.exe	82
PID 2224 wrote to memory of 1040	2224	cmd.exe	82
PID 2224 wrote to memory of 1040	2224	cmd.exe	82
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 2844 wrote to memory of 4020	2844	images.exe	83
PID 4020 wrote to memory of 3700	4020	images.exe	84
PID 4020 wrote to memory of 3700	4020	images.exe	84
PID 4020 wrote to memory of 3700	4020	images.exe	84
PID 4020 wrote to memory of 3700	4020	images.exe	84
PID 4020 wrote to memory of 3700	4020	images.exe	84

C:\Users\Admin\AppData\Local\Temp\68a40e341f28507ebd504564fc8507d3.exe
"C:\Users\Admin\AppData\Local\Temp\68a40e341f28507ebd504564fc8507d3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\68a40e341f28507ebd504564fc8507d3.exe
  C:\Users\Admin\AppData\Local\Temp\68a40e341f28507ebd504564fc8507d3.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2224
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
      4⤵
      PID:1040
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\images.exe
      C:\Users\Admin\AppData\Local\Temp\images.exe
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4020
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:3700

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/900-118-0x0000000005280000-0x0000000005281000-memory.dmp

Download

memory/900-120-0x0000000006D50000-0x0000000006DA0000-memory.dmp

Download

memory/900-121-0x0000000006FB0000-0x0000000006FB1000-memory.dmp

Download

memory/900-126-0x00000000079A0000-0x0000000007A09000-memory.dmp

Download

memory/900-127-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

Download

memory/900-119-0x0000000005240000-0x0000000005241000-memory.dmp

Download

memory/900-117-0x00000000052A0000-0x00000000052A1000-memory.dmp

Download

memory/900-114-0x00000000009B0000-0x00000000009B1000-memory.dmp

Download

memory/900-116-0x00000000057A0000-0x00000000057A1000-memory.dmp

Download

memory/2388-130-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/2388-128-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/2844-141-0x0000000005710000-0x0000000005C0E000-memory.dmp

Download

memory/3700-156-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

Download

memory/4020-154-0x0000000000400000-0x000000000055E000-memory.dmp

Download