warzonerat | 3fac732646ab12565cfd2dbdab89d71b26fad16db25a6143dfb11bf6da3bce26

General

Target

PAYMENT DOC.exe
Size

274KB
MD5

55d99749553fb93316b66f480c35d7d1
SHA1

27cad4666afbaa3b9730929fcc7cfe5d8f0999b6
SHA256

3fac732646ab12565cfd2dbdab89d71b26fad16db25a6143dfb11bf6da3bce26
SHA512

b8e4c7617d2077fd425fca7b81bbf709030127cb034a86cc7bd797c535682c1f3be53070438594e75c23915012a24655b6cfd226d34120c9cbf9fa0ff9701aa3

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

136.144.41.66:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Loads dropped DLL 1 IoCs

Processes:

PAYMENT DOC.exe

pid process

1684 PAYMENT DOC.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1980 2016 WerFault.exe PAYMENT DOC.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

WerFault.exe

pid process

1980 WerFault.exe
1980 WerFault.exe
1980 WerFault.exe
1980 WerFault.exe
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WerFault.exe

pid process

1980 WerFault.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WerFault.exe

description pid process

Token: SeDebugPrivilege 1980 WerFault.exe

pid	process
1684	PAYMENT DOC.exe

pid	pid_target	process	target process
1980	2016	WerFault.exe	PAYMENT DOC.exe

pid	process
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe
1980	WerFault.exe

pid	process
1980	WerFault.exe

description	pid	process
Token: SeDebugPrivilege	1980	WerFault.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

PAYMENT DOC.exePAYMENT DOC.exe

description	pid	process	target process
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 1684 wrote to memory of 2016	1684	PAYMENT DOC.exe	PAYMENT DOC.exe
PID 2016 wrote to memory of 1980	2016	PAYMENT DOC.exe	WerFault.exe
PID 2016 wrote to memory of 1980	2016	PAYMENT DOC.exe	WerFault.exe
PID 2016 wrote to memory of 1980	2016	PAYMENT DOC.exe	WerFault.exe
PID 2016 wrote to memory of 1980	2016	PAYMENT DOC.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\PAYMENT DOC.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT DOC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\PAYMENT DOC.exe
"C:\Users\Admin\AppData\Local\Temp\PAYMENT DOC.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2016 -s 200
3⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1980

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\nsi84BB.tmp\fnvy.dll
MD5
427f94bb1e4bcab425a637e31ba06cd8

SHA1
b354acc48de4094eb576f34ee82bd4388b218ec5

SHA256
4508751251f71301ad27604a65de0dc67ca8c284701de7e7ed1e204e9a60a8de

SHA512
71a092242d0e6b69b64963c72d7c388ae137e51f8bbf45eb5bbccfef0c08d299a3d3336cab9792d9cdd4e9413300c4485a730c9a7c8d3035d8c584515ebbe4f9

Download Submit
memory/1684-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Filesize
8KB

Download
memory/1980-73-0x0000000000000000-mapping.dmp

Download
memory/1980-74-0x00000000007B0000-0x00000000007B1000-memory.dmp

Filesize
4KB

Download
memory/2016-62-0x0000000000000000-mapping.dmp

Download
memory/2016-63-0x00000000001C0000-0x000000000031E000-memory.dmp

Filesize
1.4MB

Download
memory/2016-67-0x00000000001C0000-0x000000000031E000-memory.dmp

Filesize
1.4MB

Download
memory/2016-72-0x00000000001C0000-0x000000000031E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing