warzonerat | 8432944d28cd034b5fa922a2bec2f1b16f9df5de133d51437096d3c321d130af

Analysis

max time kernel
108s
max time network
144s
platform
windows10_x64
resource
win10-en-20211014
submitted
15/11/2021, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SBTPIVXU.EXE
Size 1.0MB
Sample211115-n86yssehgl
SHA256 8432944d28cd034b5fa922a2bec2f1b16f9df5de133d51437096d3c321d130af
MD5 eabe2f9529abddf5849ebd72cf52073b
SHA1 4e41a161c6c6f7e5c40b54c5d6a40850d6abe49d
SHA512 1501799d37abdc58ac45ef51d410856122ef8f17c3338934c12b922257c1a27f51c7046079dc08a80b653d5c41d936f64c0c16671e0a3500e6a2c30af5659735
MD5 SHA1 SHA512

Score

10^/10

warzonerat collection infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

latua.nsupdate.info:5526

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/3792-132-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Loads dropped DLL 9 IoCs

pid	Process
3792	logagent.exe
3792	logagent.exe
3792	logagent.exe
3792	logagent.exe
3792	logagent.exe
3792	logagent.exe
3792	logagent.exe
3792	logagent.exe
3792	logagent.exe

Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs

collection

Email Collection

T1114

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	logagent.exe
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	logagent.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows\CurrentVersion\Run\Sbtpivxu = "C:\\Users\\Public\\Libraries\\Sbtpivxu\\uxviptbS.url"	SBTPIVXU.EXE

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
2856	reg.exe
2052	reg.exe
2396	reg.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 3792	2272	SBTPIVXU.EXE	69
PID 2272 wrote to memory of 1012	2272	SBTPIVXU.EXE	70
PID 2272 wrote to memory of 1012	2272	SBTPIVXU.EXE	70
PID 2272 wrote to memory of 1012	2272	SBTPIVXU.EXE	70
PID 1012 wrote to memory of 3092	1012	cmd.exe	72
PID 1012 wrote to memory of 3092	1012	cmd.exe	72
PID 1012 wrote to memory of 3092	1012	cmd.exe	72
PID 3092 wrote to memory of 2856	3092	cmd.exe	74
PID 3092 wrote to memory of 2856	3092	cmd.exe	74
PID 3092 wrote to memory of 2856	3092	cmd.exe	74
PID 3092 wrote to memory of 2052	3092	cmd.exe	75
PID 3092 wrote to memory of 2052	3092	cmd.exe	75
PID 3092 wrote to memory of 2052	3092	cmd.exe	75
PID 3092 wrote to memory of 396	3092	cmd.exe	76
PID 3092 wrote to memory of 396	3092	cmd.exe	76
PID 3092 wrote to memory of 396	3092	cmd.exe	76
PID 2272 wrote to memory of 3060	2272	SBTPIVXU.EXE	78
PID 2272 wrote to memory of 3060	2272	SBTPIVXU.EXE	78
PID 2272 wrote to memory of 3060	2272	SBTPIVXU.EXE	78
PID 3060 wrote to memory of 2396	3060	cmd.exe	80
PID 3060 wrote to memory of 2396	3060	cmd.exe	80
PID 3060 wrote to memory of 2396	3060	cmd.exe	80

outlook_office_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	logagent.exe

outlook_win_path 1 IoCs

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	logagent.exe

C:\Users\Admin\AppData\Local\Temp\SBTPIVXU.EXE
"C:\Users\Admin\AppData\Local\Temp\SBTPIVXU.EXE"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  - Loads dropped DLL
  - Accesses Microsoft Outlook profiles
  - outlook_office_path
  - outlook_win_path
  PID:3792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\Trast.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\UKO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\SysWOW64\reg.exe
      reg delete hkcu\Environment /v windir /f
      4⤵
      Modifies registry key
      PID:2856
  - - C:\Windows\SysWOW64\reg.exe
      reg add hkcu\Environment /v windir /d "cmd /c start /min C:\Users\Public\KDECO.bat reg delete hkcu\Environment /v windir /f && REM "
      4⤵
      Modifies registry key
      PID:2052
  - - C:\Windows\SysWOW64\schtasks.exe
      schtasks /Run /TN \Microsoft\Windows\DiskCleanup\SilentCleanup /I
      4⤵
      PID:396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Public\nest.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3060
- - C:\Windows\SysWOW64\reg.exe
    reg delete hkcu\Environment /v windir /f
    3⤵
    - Modifies registry key
    PID:2396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

T1114

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2272-118-0x0000000000590000-0x00000000006DA000-memory.dmp

Download

memory/2272-119-0x0000000002361000-0x0000000002375000-memory.dmp

Download

memory/3792-133-0x0000000005B10000-0x0000000005B94000-memory.dmp

Download

memory/3792-132-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3792-130-0x0000000000C10000-0x0000000000C11000-memory.dmp

Download

memory/3792-131-0x00000000726E0000-0x0000000072836000-memory.dmp

Download

memory/3792-128-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/3792-129-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads