warzonerat | a98237e2ebf6a05173e905842d88a2fa8e721b1cff76942ff3bd99176a35c18f

General

Target
7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe
Size 594KB
Sample210903-pcnm1sdac2
SHA256 a98237e2ebf6a05173e905842d88a2fa8e721b1cff76942ff3bd99176a35c18f
MD5 7cdbaac6ce5de3023ac8b8ebf17cbb1f
SHA1 6afb2bcf49cdca85a4781ffe7816a2551329e41e
SHA512 ba6fde3df44ee3bfccdc95000769f5544f98d2f9fc5eb8c8032d533c952c2d08e4cec7aa54e76adf06c4375f0d1d00a6b3d3292762d14a6dadd1069b2c944451
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

20.150.137.35:7400

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/1740-125-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1740-126-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1740-127-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 776 set thread context of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
3000	schtasks.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 776 wrote to memory of 3000	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	78
PID 776 wrote to memory of 3000	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	78
PID 776 wrote to memory of 3000	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	78
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80
PID 776 wrote to memory of 1740	776	7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe	80

C:\Users\Admin\AppData\Local\Temp\7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe
"C:\Users\Admin\AppData\Local\Temp\7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:776
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AGZlgTRPpoZZj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFDAF.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:3000
- C:\Users\Admin\AppData\Local\Temp\7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe
  "C:\Users\Admin\AppData\Local\Temp\7cdbaac6ce5de3023ac8b8ebf17cbb1f.exe"
  2⤵
  PID:1740

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/776-121-0x0000000009930000-0x0000000009931000-memory.dmp

Download

memory/776-116-0x0000000007A30000-0x0000000007A31000-memory.dmp

Download

memory/776-117-0x00000000075D0000-0x00000000075D1000-memory.dmp

Download

memory/776-118-0x0000000007530000-0x0000000007A2E000-memory.dmp

Download

memory/776-119-0x0000000007560000-0x0000000007561000-memory.dmp

Download

memory/776-120-0x00000000079D0000-0x00000000079E6000-memory.dmp

Download

memory/776-114-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/776-122-0x00000000098C0000-0x0000000009912000-memory.dmp

Download

memory/776-123-0x00000000011A0000-0x00000000011BE000-memory.dmp

Download

memory/1740-125-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1740-127-0x0000000000400000-0x0000000000554000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads