9e6b019dfbd2127debf97d9700db1efa

General
Target

9e6b019dfbd2127debf97d9700db1efa.exe

Filesize

819KB

Completed

15-09-2021 07:00

Score
10 /10
MD5

9e6b019dfbd2127debf97d9700db1efa

SHA1

6dac4ba3a4a2eed8e8646b254d369a9ce36ac04e

SHA256

14b699de8b60b775bd609d8b07b70d0f1bbb850e75347d9b925e54c8dba68fd1

Malware Config

Extracted

Family warzonerat
C2

194.127.179.121:5010

Signatures 5

Filter: none

Defense Evasion
Persistence
  • WarzoneRat, AveMaria

    Description

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

  • Warzone RAT Payload

    Tags

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/4612-125-0x0000000000400000-0x0000000000554000-memory.dmpwarzonerat
  • Adds Run key to start application
    9e6b019dfbd2127debf97d9700db1efa.exe

    TTPs

    Registry Run Keys / Startup FolderModify Registry

    Reported IOCs

    descriptioniocprocess
    Set value (str)\REGISTRY\USER\S-1-5-21-2559286294-2439613352-4032193287-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zmjirkn = "C:\\Users\\Public\\Libraries\\nkrijmZ.url"9e6b019dfbd2127debf97d9700db1efa.exe
  • Modifies registry key
    reg.exereg.exereg.exe

    TTPs

    Modify Registry

    Reported IOCs

    pidprocess
    4784reg.exe
    4804reg.exe
    2088reg.exe
  • Suspicious use of WriteProcessMemory
    9e6b019dfbd2127debf97d9700db1efa.execmd.execmd.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 461244729e6b019dfbd2127debf97d9700db1efa.exelogagent.exe
    PID 4472 wrote to memory of 464844729e6b019dfbd2127debf97d9700db1efa.execmd.exe
    PID 4472 wrote to memory of 464844729e6b019dfbd2127debf97d9700db1efa.execmd.exe
    PID 4472 wrote to memory of 464844729e6b019dfbd2127debf97d9700db1efa.execmd.exe
    PID 4648 wrote to memory of 47244648cmd.execmd.exe
    PID 4648 wrote to memory of 47244648cmd.execmd.exe
    PID 4648 wrote to memory of 47244648cmd.execmd.exe
    PID 4724 wrote to memory of 47844724cmd.exereg.exe
    PID 4724 wrote to memory of 47844724cmd.exereg.exe
    PID 4724 wrote to memory of 47844724cmd.exereg.exe
    PID 4724 wrote to memory of 48044724cmd.exereg.exe
    PID 4724 wrote to memory of 48044724cmd.exereg.exe
    PID 4724 wrote to memory of 48044724cmd.exereg.exe
    PID 4724 wrote to memory of 48244724cmd.exeschtasks.exe
    PID 4724 wrote to memory of 48244724cmd.exeschtasks.exe
    PID 4724 wrote to memory of 48244724cmd.exeschtasks.exe
    PID 4472 wrote to memory of 511244729e6b019dfbd2127debf97d9700db1efa.execmd.exe
    PID 4472 wrote to memory of 511244729e6b019dfbd2127debf97d9700db1efa.execmd.exe
    PID 4472 wrote to memory of 511244729e6b019dfbd2127debf97d9700db1efa.execmd.exe
    PID 5112 wrote to memory of 20885112cmd.exereg.exe
    PID 5112 wrote to memory of 20885112cmd.exereg.exe
    PID 5112 wrote to memory of 20885112cmd.exereg.exe
Processes 9
  • C:\Users\Admin\AppData\Local\Temp\9e6b019dfbd2127debf97d9700db1efa.exe
    "C:\Users\Admin\AppData\Local\Temp\9e6b019dfbd2127debf97d9700db1efa.exe"
    Adds Run key to start application
    Suspicious use of WriteProcessMemory
    PID:4472
    • C:\Windows\SysWOW64\logagent.exe
      C:\Windows\System32\logagent.exe
      PID:4612
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
      Suspicious use of WriteProcessMemory
      PID:4648
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
        Suspicious use of WriteProcessMemory
        PID:4724
        • C:\Windows\SysWOW64\reg.exe
          reg delete hkcu\Environment /v windir /f
          Modifies registry key
          PID:4784
        • C:\Windows\SysWOW64\reg.exe
          reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
          Modifies registry key
          PID:4804
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
          PID:4824
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
      Suspicious use of WriteProcessMemory
      PID:5112
      • C:\Windows\SysWOW64\reg.exe
        reg delete hkcu\Environment /v windir /f
        Modifies registry key
        PID:2088
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Discovery
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • C:\Users\Public\Trast.bat

                        MD5

                        4068c9f69fcd8a171c67f81d4a952a54

                        SHA1

                        4d2536a8c28cdcc17465e20d6693fb9e8e713b36

                        SHA256

                        24222300c78180b50ed1f8361ba63cb27316ec994c1c9079708a51b4a1a9d810

                        SHA512

                        a64f9319acc51fffd0491c74dcd9c9084c2783b82f95727e4bfe387a8528c6dcf68f11418e88f1e133d115daf907549c86dd7ad866b2a7938add5225fbb2811d

                      • C:\Users\Public\UKO.bat

                        MD5

                        eaf8d967454c3bbddbf2e05a421411f8

                        SHA1

                        6170880409b24de75c2dc3d56a506fbff7f6622c

                        SHA256

                        f35f2658455a2e40f151549a7d6465a836c33fa9109e67623916f889849eac56

                        SHA512

                        fe5be5c673e99f70c93019d01abb0a29dd2ecf25b2d895190ff551f020c28e7d8f99f65007f440f0f76c5bcac343b2a179a94d190c938ea3b9e1197890a412e9

                      • C:\Users\Public\nest.bat

                        MD5

                        8ada51400b7915de2124baaf75e3414c

                        SHA1

                        1a7b9db12184ab7fd7fce1c383f9670a00adb081

                        SHA256

                        45aa3957c29865260a78f03eef18ae9aebdbf7bea751ecc88be4a799f2bb46c7

                        SHA512

                        9afc138157a4565294ca49942579cdb6f5d8084e56f9354738de62b585f4c0fa3e7f2cbc9541827f2084e3ff36c46eed29b46f5dd2444062ffcd05c599992e68

                      • memory/2088-134-0x0000000000000000-mapping.dmp

                      • memory/4472-115-0x0000000000570000-0x000000000061E000-memory.dmp

                      • memory/4612-121-0x0000000000960000-0x0000000000961000-memory.dmp

                      • memory/4612-124-0x0000000010670000-0x00000000107C6000-memory.dmp

                      • memory/4612-125-0x0000000000400000-0x0000000000554000-memory.dmp

                      • memory/4612-122-0x0000000000C20000-0x0000000000C21000-memory.dmp

                      • memory/4612-119-0x0000000000000000-mapping.dmp

                      • memory/4612-123-0x00000000009C0000-0x00000000009C1000-memory.dmp

                      • memory/4648-120-0x0000000000000000-mapping.dmp

                      • memory/4724-127-0x0000000000000000-mapping.dmp

                      • memory/4784-129-0x0000000000000000-mapping.dmp

                      • memory/4804-130-0x0000000000000000-mapping.dmp

                      • memory/4824-131-0x0000000000000000-mapping.dmp

                      • memory/5112-132-0x0000000000000000-mapping.dmp