warzonerat | 6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155

General

Target

6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
Size

468KB
MD5

d26d6378054ebb19f2b241722304c9ad
SHA1

0888dbbb5170d82bbff12fa68c70d4d0ec4d7d1b
SHA256

6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155
SHA512

3f43c1b27d1f7e19f95b25a2ee7b3695aee3a7cf2c0b77ba15f2ee62b50a30ca2aec2c287573d17ab20144b78a98ae1a7f2eee4cc3232d4bc8a052b2cb965d33

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

152.67.253.163:5300

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/816-127-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/816-128-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/816-129-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe

description	pid	process	target process
PID 3704 set thread context of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

592 schtasks.exe

pid	process
592	schtasks.exe

Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe

pid	process
3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe

description	pid	process	target process
PID 3704 wrote to memory of 592	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	schtasks.exe
PID 3704 wrote to memory of 592	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	schtasks.exe
PID 3704 wrote to memory of 592	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	schtasks.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
PID 3704 wrote to memory of 816	3704	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe	6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe

C:\Users\Admin\AppData\Local\Temp\6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
"C:\Users\Admin\AppData\Local\Temp\6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3704

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\moXtqcuGpIAEyi" /XML "C:\Users\Admin\AppData\Local\Temp\tmp39C9.tmp"
2⤵
- Creates scheduled task(s)
PID:592

C:\Users\Admin\AppData\Local\Temp\6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe
"C:\Users\Admin\AppData\Local\Temp\6eba12f646eaa800404cc49e96ddabbb73478712145b220971d9a21b97e54155.exe"
2⤵
PID:816

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/592-126-0x0000000000000000-mapping.dmp

Download
memory/816-129-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/816-128-0x0000000000405CE2-mapping.dmp

Download
memory/816-127-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3704-122-0x00000000094C0000-0x00000000094C8000-memory.dmp

Filesize
32KB

Download
memory/3704-121-0x0000000005631000-0x0000000005632000-memory.dmp

Filesize
4KB

Download
memory/3704-115-0x0000000000D60000-0x0000000000D61000-memory.dmp

Filesize
4KB

Download
memory/3704-123-0x0000000005632000-0x0000000005633000-memory.dmp

Filesize
4KB

Download
memory/3704-124-0x00000000099E0000-0x00000000099E1000-memory.dmp

Filesize
4KB

Download
memory/3704-125-0x0000000009990000-0x00000000099CE000-memory.dmp

Filesize
248KB

Download
memory/3704-120-0x0000000005630000-0x0000000005631000-memory.dmp

Filesize
4KB

Download
memory/3704-119-0x0000000005610000-0x0000000005611000-memory.dmp

Filesize
4KB

Download
memory/3704-118-0x0000000005670000-0x0000000005671000-memory.dmp

Filesize
4KB

Download
memory/3704-117-0x0000000005B70000-0x0000000005B71000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads