warzonerat | ff5c1829e2ad044ec148a71766e4cd62ca12a528062e7da001c787cfb37be27d

Analysis

max time kernel
144s
max time network
150s
platform
windows10_x64
resource
win10v20210408
submitted
16/09/2021, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SMSS ORDER 5676884767638,pdf.exe
Size 812KB
Sample210916-rdtxjagdem
SHA256 ff5c1829e2ad044ec148a71766e4cd62ca12a528062e7da001c787cfb37be27d
MD5 937e78726308b2076df4b8be19a4d151
SHA1 8bea8d60dc0137ea3720e1caa5c369d8dc98f349
SHA512 4ced9ff50fa10dce0d6bcc2b134f24ea6f114b288b62ae456fc1e8dd7f7b676501c458ab1a20255a7ca88523bebd95f5148b54e2ed7ecb5ed8d959d7f7592413
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

blessthychild.ddns.net:6014

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2996-128-0x0000000004570000-0x00000000046C4000-memory.dmp	warzonerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dmvzpur = "C:\\Users\\Public\\Libraries\\rupzvmD.url"	SMSS ORDER 5676884767638,pdf.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1284	reg.exe
580	reg.exe
812	reg.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 2996	3920	SMSS ORDER 5676884767638,pdf.exe	68
PID 3920 wrote to memory of 1772	3920	SMSS ORDER 5676884767638,pdf.exe	69
PID 3920 wrote to memory of 1772	3920	SMSS ORDER 5676884767638,pdf.exe	69
PID 3920 wrote to memory of 1772	3920	SMSS ORDER 5676884767638,pdf.exe	69
PID 1772 wrote to memory of 4072	1772	cmd.exe	71
PID 1772 wrote to memory of 4072	1772	cmd.exe	71
PID 1772 wrote to memory of 4072	1772	cmd.exe	71
PID 4072 wrote to memory of 580	4072	cmd.exe	73
PID 4072 wrote to memory of 580	4072	cmd.exe	73
PID 4072 wrote to memory of 580	4072	cmd.exe	73
PID 4072 wrote to memory of 812	4072	cmd.exe	74
PID 4072 wrote to memory of 812	4072	cmd.exe	74
PID 4072 wrote to memory of 812	4072	cmd.exe	74
PID 4072 wrote to memory of 992	4072	cmd.exe	75
PID 4072 wrote to memory of 992	4072	cmd.exe	75
PID 4072 wrote to memory of 992	4072	cmd.exe	75
PID 3920 wrote to memory of 880	3920	SMSS ORDER 5676884767638,pdf.exe	76
PID 3920 wrote to memory of 880	3920	SMSS ORDER 5676884767638,pdf.exe	76
PID 3920 wrote to memory of 880	3920	SMSS ORDER 5676884767638,pdf.exe	76
PID 880 wrote to memory of 1284	880	cmd.exe	78
PID 880 wrote to memory of 1284	880	cmd.exe	78
PID 880 wrote to memory of 1284	880	cmd.exe	78

C:\Users\Admin\AppData\Local\Temp\SMSS ORDER 5676884767638,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\SMSS ORDER 5676884767638,pdf.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\DpiScaling.exe
  C:\Windows\System32\DpiScaling.exe
  2⤵
  PID:2996
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4072
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:580
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:812
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:992
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:880
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:1284

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2996-123-0x00000000005D0000-0x00000000005D1000-memory.dmp

Download

memory/2996-125-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/2996-127-0x0000000000510000-0x0000000000511000-memory.dmp

Download

memory/2996-126-0x0000000010670000-0x00000000107C6000-memory.dmp

Download

memory/2996-128-0x0000000004570000-0x00000000046C4000-memory.dmp

Download

memory/3920-114-0x00000000004E0000-0x000000000058E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads