warzonerat | 895c00426f8a3de65c065104f4988f1db0f64b916b44d705ac95b27a7b049aea

General

Target

SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
Size

557KB
MD5

513d95f880ef4b0522a50c4374e40f1f
SHA1

b89d35ab5f89a5c984ea7d4a46ced8e1603a866b
SHA256

a28d456ec326f62b15dc6257859619c1a2dc6817f332adb9c87fbb146676dc00
SHA512

922d8d138fdf2dfb77770697c57def5973d07a4d64fe5d7effeee30987330dd2611b97cb9df8da78d0cb42a35673800224fd49b6fe44f4c4f0e38dd00a6eb750

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

176.126.86.243:2021

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 4 IoCs

rat

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\for 176.126.86.243.exe	warzonerat
C:\Users\Admin\AppData\Local\Temp\for 176.126.86.243.exe	warzonerat
C:\ProgramData\microsoftupdate.exe	warzonerat
C:\ProgramData\microsoftupdate.exe	warzonerat

Executes dropped EXE 3 IoCs

Processes:

for 176.126.86.243.exeBTC STEALER.exemicrosoftupdate.exe

pid process

3872 for 176.126.86.243.exe
1240 BTC STEALER.exe
876 microsoftupdate.exe
Drops startup file 1 IoCs

Processes:

BTC STEALER.exe

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.lnk BTC STEALER.exe

pid	process
3872	for 176.126.86.243.exe
1240	BTC STEALER.exe
876	microsoftupdate.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WindowsUpdater.lnk	BTC STEALER.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

BTC STEALER.exefor 176.126.86.243.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsUpdater = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\BTC STEALER.exe\" .."	BTC STEALER.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windowsdefender = "C:\\ProgramData\\microsoftupdate.exe"	for 176.126.86.243.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe

description	pid	process	target process
PID 1860 set thread context of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1564 schtasks.exe

pid	process
1564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe

pid	process
1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe

description pid process

Token: SeDebugPrivilege 1860 SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe

description	pid	process
Token: SeDebugPrivilege	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exeSECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exefor 176.126.86.243.exemicrosoftupdate.exe

description	pid	process	target process
PID 1860 wrote to memory of 1564	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	schtasks.exe
PID 1860 wrote to memory of 1564	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	schtasks.exe
PID 1860 wrote to memory of 1564	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	schtasks.exe
PID 1860 wrote to memory of 1608	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1608	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1608	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1860 wrote to memory of 1580	1860	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
PID 1580 wrote to memory of 3872	1580	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	for 176.126.86.243.exe
PID 1580 wrote to memory of 3872	1580	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	for 176.126.86.243.exe
PID 1580 wrote to memory of 3872	1580	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	for 176.126.86.243.exe
PID 1580 wrote to memory of 1240	1580	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	BTC STEALER.exe
PID 1580 wrote to memory of 1240	1580	SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe	BTC STEALER.exe
PID 3872 wrote to memory of 876	3872	for 176.126.86.243.exe	microsoftupdate.exe
PID 3872 wrote to memory of 876	3872	for 176.126.86.243.exe	microsoftupdate.exe
PID 3872 wrote to memory of 876	3872	for 176.126.86.243.exe	microsoftupdate.exe
PID 876 wrote to memory of 1964	876	microsoftupdate.exe	cmd.exe
PID 876 wrote to memory of 1964	876	microsoftupdate.exe	cmd.exe
PID 876 wrote to memory of 1964	876	microsoftupdate.exe	cmd.exe
PID 876 wrote to memory of 1964	876	microsoftupdate.exe	cmd.exe
PID 876 wrote to memory of 1964	876	microsoftupdate.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
"C:\Users\Admin\AppData\Local\Temp\SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qHBYWHQISskoYw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5B3B.tmp"
2⤵
- Creates scheduled task(s)
PID:1564

C:\Users\Admin\AppData\Local\Temp\SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
"C:\Users\Admin\AppData\Local\Temp\SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe"
2⤵
PID:1608

C:\Users\Admin\AppData\Local\Temp\SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe
"C:\Users\Admin\AppData\Local\Temp\SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Temp\for 176.126.86.243.exe
"C:\Users\Admin\AppData\Local\Temp\for 176.126.86.243.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3872

C:\ProgramData\microsoftupdate.exe
"C:\ProgramData\microsoftupdate.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:876

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
5⤵
PID:1964

C:\Users\Admin\AppData\Local\Temp\BTC STEALER.exe
"C:\Users\Admin\AppData\Local\Temp\BTC STEALER.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
PID:1240

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Registry Run Keys / Startup Folder

1

T1060

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\microsoftupdate.exe
MD5
bd5f146a5f4796e27868d4ca83dae4ee

SHA1
cfa2a086c52c94d387c0ab19b514881b47ab4490

SHA256
066c455fdfc44d36695e2e0a97c41c25e8d2d21a90576f649159b16af4ffd860

SHA512
5f2cfffde1a60fc3810330304611c39b8350fdc7b87e5e0e2a4186647ab8a68ca23cd5259bc3672db0c3505ff9fcccad5797f511531a7eabc6bc56b705e129a4

Download Submit
C:\ProgramData\microsoftupdate.exe
MD5
bd5f146a5f4796e27868d4ca83dae4ee

SHA1
cfa2a086c52c94d387c0ab19b514881b47ab4490

SHA256
066c455fdfc44d36695e2e0a97c41c25e8d2d21a90576f649159b16af4ffd860

SHA512
5f2cfffde1a60fc3810330304611c39b8350fdc7b87e5e0e2a4186647ab8a68ca23cd5259bc3672db0c3505ff9fcccad5797f511531a7eabc6bc56b705e129a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SECOND-STATEMENT OF ACCOUNT_2021-10-04989829.bat.exe.log
MD5
0c2899d7c6746f42d5bbe088c777f94c

SHA1
622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1

SHA256
5b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458

SHA512
ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078

Download Submit
C:\Users\Admin\AppData\Local\Temp\BTC STEALER.exe
MD5
2c97c34c375bd1fe92a6ff4c272c2096

SHA1
af1b4c20af78ce0247d69a8bddaa6234a02692ef

SHA256
321c0146561f0448a08d290535bdcc7e8fb606648ab6b5be5330e7fdc2866427

SHA512
99b9599a27b151a5c8cf960feb9c1696312a8b3c4f1397744c6d6891af773fc5708acac9ddad8a968ef0badb7f5905eddd2a3c75d3d5170ad33bbf5012904235

Download Submit
C:\Users\Admin\AppData\Local\Temp\BTC STEALER.exe
MD5
2c97c34c375bd1fe92a6ff4c272c2096

SHA1
af1b4c20af78ce0247d69a8bddaa6234a02692ef

SHA256
321c0146561f0448a08d290535bdcc7e8fb606648ab6b5be5330e7fdc2866427

SHA512
99b9599a27b151a5c8cf960feb9c1696312a8b3c4f1397744c6d6891af773fc5708acac9ddad8a968ef0badb7f5905eddd2a3c75d3d5170ad33bbf5012904235

Download Submit
C:\Users\Admin\AppData\Local\Temp\for 176.126.86.243.exe
MD5
bd5f146a5f4796e27868d4ca83dae4ee

SHA1
cfa2a086c52c94d387c0ab19b514881b47ab4490

SHA256
066c455fdfc44d36695e2e0a97c41c25e8d2d21a90576f649159b16af4ffd860

SHA512
5f2cfffde1a60fc3810330304611c39b8350fdc7b87e5e0e2a4186647ab8a68ca23cd5259bc3672db0c3505ff9fcccad5797f511531a7eabc6bc56b705e129a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\for 176.126.86.243.exe
MD5
bd5f146a5f4796e27868d4ca83dae4ee

SHA1
cfa2a086c52c94d387c0ab19b514881b47ab4490

SHA256
066c455fdfc44d36695e2e0a97c41c25e8d2d21a90576f649159b16af4ffd860

SHA512
5f2cfffde1a60fc3810330304611c39b8350fdc7b87e5e0e2a4186647ab8a68ca23cd5259bc3672db0c3505ff9fcccad5797f511531a7eabc6bc56b705e129a4

Download Submit
memory/876-139-0x0000000000000000-mapping.dmp

Download
memory/1240-142-0x0000000002C42000-0x0000000002C44000-memory.dmp

Filesize
8KB

Download
memory/1240-138-0x0000000002C40000-0x0000000002C42000-memory.dmp

Filesize
8KB

Download
memory/1240-135-0x0000000000000000-mapping.dmp

Download
memory/1564-124-0x0000000000000000-mapping.dmp

Download
memory/1580-131-0x00000000054B0000-0x00000000054B1000-memory.dmp

Filesize
4KB

Download
memory/1580-125-0x0000000000400000-0x0000000000434000-memory.dmp

Filesize
208KB

Download
memory/1580-126-0x000000000042E77E-mapping.dmp

Download
memory/1860-121-0x0000000007F80000-0x0000000007F81000-memory.dmp

Filesize
4KB

Download
memory/1860-123-0x0000000008340000-0x0000000008393000-memory.dmp

Filesize
332KB

Download
memory/1860-122-0x0000000005180000-0x000000000518A000-memory.dmp

Filesize
40KB

Download
memory/1860-115-0x0000000000620000-0x0000000000621000-memory.dmp

Filesize
4KB

Download
memory/1860-120-0x0000000004EE0000-0x00000000053DE000-memory.dmp

Filesize
5.0MB

Download
memory/1860-119-0x0000000004F00000-0x0000000004F01000-memory.dmp

Filesize
4KB

Download
memory/1860-118-0x0000000004F80000-0x0000000004F81000-memory.dmp

Filesize
4KB

Download
memory/1860-117-0x00000000053E0000-0x00000000053E1000-memory.dmp

Filesize
4KB

Download
memory/1964-143-0x0000000000000000-mapping.dmp

Download
memory/1964-144-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Filesize
4KB

Download
memory/3872-132-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads