warzonerat | 80b79a1e0a0465c79c961eb29c35e38c32c9403f4e95c2bb457e2b03ca0a82f2

Analysis

max time kernel
161s
max time network
160s
platform
windows10_x64
resource
win10-en-20211208
submitted
07/01/2022, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Solicite una cotización,pdf.exe
Size 1022KB
Sample220107-r2fd2scgdj
SHA256 80b79a1e0a0465c79c961eb29c35e38c32c9403f4e95c2bb457e2b03ca0a82f2
MD5 39b7ff7403d5232976f4548ab343aaf2
SHA1 c50ebe9bc8493f788163138c7f1d6c382cfdc2ff
SHA512 62c3f1c7cbe28de55a89c0022e0b491ba4c98bb4d840bb11b63855d31e7e955b7d5e0c679c989bcf265afe70f798823db55335a98d37f804290e8502a7aef56f
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

185.140.53.133:3344

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2864-128-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2864-129-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/2864-130-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4064-145-0x0000000000405CE2-mapping.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
1404	microsoftupdate.exe
4064	microsoftupdate.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windowsdefender = "C:\\ProgramData\\microsoftupdate.exe"	Solicite una cotización,pdf.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2664 set thread context of 2864	2664	Solicite una cotización,pdf.exe	69
PID 1404 set thread context of 4064	1404	microsoftupdate.exe	73

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2664 wrote to memory of 2864	2664	Solicite una cotización,pdf.exe	69
PID 2864 wrote to memory of 1404	2864	Solicite una cotización,pdf.exe	70
PID 2864 wrote to memory of 1404	2864	Solicite una cotización,pdf.exe	70
PID 2864 wrote to memory of 1404	2864	Solicite una cotización,pdf.exe	70
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 1404 wrote to memory of 4064	1404	microsoftupdate.exe	73
PID 4064 wrote to memory of 352	4064	microsoftupdate.exe	74
PID 4064 wrote to memory of 352	4064	microsoftupdate.exe	74
PID 4064 wrote to memory of 352	4064	microsoftupdate.exe	74
PID 4064 wrote to memory of 352	4064	microsoftupdate.exe	74
PID 4064 wrote to memory of 352	4064	microsoftupdate.exe	74

C:\Users\Admin\AppData\Local\Temp\Solicite una cotización,pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Solicite una cotización,pdf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Users\Admin\AppData\Local\Temp\Solicite una cotización,pdf.exe
  "C:\Users\Admin\AppData\Local\Temp\Solicite una cotización,pdf.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\ProgramData\microsoftupdate.exe
    "C:\ProgramData\microsoftupdate.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1404
  - - C:\ProgramData\microsoftupdate.exe
      "C:\ProgramData\microsoftupdate.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4064
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/352-148-0x00000000027E0000-0x00000000027E1000-memory.dmp

Download

memory/1404-139-0x0000000008530000-0x000000000853C000-memory.dmp

Download

memory/1404-142-0x00000000087D0000-0x000000000881B000-memory.dmp

Download

memory/1404-143-0x0000000008A60000-0x0000000008AAE000-memory.dmp

Download

memory/1404-141-0x0000000008870000-0x000000000890C000-memory.dmp

Download

memory/1404-140-0x0000000005430000-0x000000000592E000-memory.dmp

Download

memory/1404-138-0x0000000005590000-0x000000000559A000-memory.dmp

Download

memory/1404-137-0x0000000005430000-0x00000000054C2000-memory.dmp

Download

memory/1404-136-0x0000000005930000-0x0000000005E2E000-memory.dmp

Download

memory/1404-135-0x0000000000AD0000-0x0000000000BD8000-memory.dmp

Download

memory/1404-134-0x0000000000AD0000-0x0000000000BD8000-memory.dmp

Download

memory/2664-125-0x00000000083F0000-0x000000000848C000-memory.dmp

Download

memory/2664-121-0x0000000004A20000-0x0000000004AB2000-memory.dmp

Download

memory/2664-119-0x0000000000080000-0x0000000000188000-memory.dmp

Download

memory/2664-126-0x0000000008350000-0x000000000839B000-memory.dmp

Download

memory/2664-127-0x00000000084E0000-0x000000000852E000-memory.dmp

Download

memory/2664-118-0x0000000000080000-0x0000000000188000-memory.dmp

Download

memory/2664-124-0x00000000080B0000-0x00000000080BC000-memory.dmp

Download

memory/2664-120-0x0000000004E80000-0x000000000537E000-memory.dmp

Download

memory/2664-123-0x00000000049D0000-0x00000000049DA000-memory.dmp

Download

memory/2664-122-0x0000000004980000-0x0000000004E7E000-memory.dmp

Download

memory/2864-128-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2864-130-0x0000000000400000-0x0000000000554000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads