warzonerat | 8c2d5674630a01a7f4cea1a683081412200ecbe413a80dbe922d9eefc66fa587

General

Target

primary_analysis_subject.exe
Size

295KB
MD5

fb522d468e6fc7187053a57e8300381b
SHA1

39185e27ea4210a3aa070dadbe91575c891603d8
SHA256

6062a0392b4b785d926964a9d535a78775770fde2acf70489a13f6ea2ff811d1
SHA512

a25138d1f5ae3801fbb1e3020582c3980237321ff2bc647a153b7496d1154008ef4efc057e76a3c64f27c083d83220589e45f9f7e4e571f869a7fe05c740c57a

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

mondaynew22.3utilities.com:3645

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 1664 created 3268 1664 WerFault.exe primary_analysis_subject.exe
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

description	pid	process	target process
PID 1664 created 3268	1664	WerFault.exe	primary_analysis_subject.exe

Warzone RAT Payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/3268-119-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3268-120-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/3268-121-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3592-132-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/3592-135-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

Processes:

images.exeimages.exe

pid process

4080 images.exe
3592 images.exe

pid	process
4080	images.exe
3592	images.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

images.exeprimary_analysis_subject.exeprimary_analysis_subject.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvvg = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\hhvvg.exe\""	images.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\hhvvg = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\hhvvg.exe\""	primary_analysis_subject.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	primary_analysis_subject.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

primary_analysis_subject.exeimages.exe

description	pid	process	target process
PID 580 set thread context of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 4080 set thread context of 3592	4080	images.exe	images.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1664 3268 WerFault.exe primary_analysis_subject.exe

pid	pid_target	process	target process
1664	3268	WerFault.exe	primary_analysis_subject.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

primary_analysis_subject.exeimages.exe

pid	process
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
580	primary_analysis_subject.exe
4080	images.exe
4080	images.exe
4080	images.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

primary_analysis_subject.exeimages.exe

description pid process

Token: SeDebugPrivilege 580 primary_analysis_subject.exe
Token: SeDebugPrivilege 4080 images.exe

description	pid	process
Token: SeDebugPrivilege	580	primary_analysis_subject.exe
Token: SeDebugPrivilege	4080	images.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

primary_analysis_subject.exeprimary_analysis_subject.exeimages.exeimages.exe

description	pid	process	target process
PID 580 wrote to memory of 2828	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 2828	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 2828	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3004	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3004	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3004	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 2820	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 2820	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 2820	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 580 wrote to memory of 3268	580	primary_analysis_subject.exe	primary_analysis_subject.exe
PID 3268 wrote to memory of 4080	3268	primary_analysis_subject.exe	images.exe
PID 3268 wrote to memory of 4080	3268	primary_analysis_subject.exe	images.exe
PID 3268 wrote to memory of 4080	3268	primary_analysis_subject.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 4080 wrote to memory of 3592	4080	images.exe	images.exe
PID 3592 wrote to memory of 3196	3592	images.exe	cmd.exe
PID 3592 wrote to memory of 3196	3592	images.exe	cmd.exe
PID 3592 wrote to memory of 3196	3592	images.exe	cmd.exe
PID 3592 wrote to memory of 3196	3592	images.exe	cmd.exe
PID 3592 wrote to memory of 3196	3592	images.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe
"C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:580

C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe
C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe gujiytjku5yezchyjli
2⤵
PID:2828

C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe
C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe gujiytjku5yezchyjli
2⤵
PID:3004

C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe
C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe gujiytjku5yezchyjli
2⤵
PID:2820

C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe
C:\Users\Admin\AppData\Local\Temp\primary_analysis_subject.exe gujiytjku5yezchyjli
2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3268

C:\ProgramData\images.exe
"C:\ProgramData\images.exe"
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080

C:\Users\Admin\AppData\Local\Temp\images.exe
C:\Users\Admin\AppData\Local\Temp\images.exe gujiytjku5yezchyjli
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3592

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
5⤵
PID:3196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3268 -s 584
3⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
PID:1664

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\images.exe
MD5
fb522d468e6fc7187053a57e8300381b

SHA1
39185e27ea4210a3aa070dadbe91575c891603d8

SHA256
6062a0392b4b785d926964a9d535a78775770fde2acf70489a13f6ea2ff811d1

SHA512
a25138d1f5ae3801fbb1e3020582c3980237321ff2bc647a153b7496d1154008ef4efc057e76a3c64f27c083d83220589e45f9f7e4e571f869a7fe05c740c57a

Download Submit
C:\ProgramData\images.exe
MD5
fb522d468e6fc7187053a57e8300381b

SHA1
39185e27ea4210a3aa070dadbe91575c891603d8

SHA256
6062a0392b4b785d926964a9d535a78775770fde2acf70489a13f6ea2ff811d1

SHA512
a25138d1f5ae3801fbb1e3020582c3980237321ff2bc647a153b7496d1154008ef4efc057e76a3c64f27c083d83220589e45f9f7e4e571f869a7fe05c740c57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\images.exe
MD5
fb522d468e6fc7187053a57e8300381b

SHA1
39185e27ea4210a3aa070dadbe91575c891603d8

SHA256
6062a0392b4b785d926964a9d535a78775770fde2acf70489a13f6ea2ff811d1

SHA512
a25138d1f5ae3801fbb1e3020582c3980237321ff2bc647a153b7496d1154008ef4efc057e76a3c64f27c083d83220589e45f9f7e4e571f869a7fe05c740c57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\images.exe
MD5
fb522d468e6fc7187053a57e8300381b

SHA1
39185e27ea4210a3aa070dadbe91575c891603d8

SHA256
6062a0392b4b785d926964a9d535a78775770fde2acf70489a13f6ea2ff811d1

SHA512
a25138d1f5ae3801fbb1e3020582c3980237321ff2bc647a153b7496d1154008ef4efc057e76a3c64f27c083d83220589e45f9f7e4e571f869a7fe05c740c57a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\hhvvg.exe
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/580-116-0x0000000004930000-0x0000000004931000-memory.dmp

Filesize
4KB

Download
memory/580-117-0x0000000005510000-0x00000000055A3000-memory.dmp

Filesize
588KB

Download
memory/580-118-0x00000000007A0000-0x00000000007BB000-memory.dmp

Filesize
108KB

Download
memory/580-114-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/3196-137-0x0000000000030000-0x0000000000031000-memory.dmp

Filesize
4KB

Download
memory/3196-136-0x0000000000000000-mapping.dmp

Download
memory/3268-119-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3268-121-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3268-120-0x0000000000405CE2-mapping.dmp

Download
memory/3592-132-0x0000000000405CE2-mapping.dmp

Download
memory/3592-135-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4080-128-0x00000000051E0000-0x00000000051E1000-memory.dmp

Filesize
4KB

Download
memory/4080-122-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads