warzonerat | 50c81d130e719ea4d1f5cf0d682c76bd1db7778dde3c8347d18f55bcdafaa73f

Analysis

max time kernel
122s
max time network
152s
platform
windows10_x64
resource
win10-en-20211208
submitted
12/01/2022, 08:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87f8b24a296aba8f3ec16ea107291aee.exe
Size 317KB
Sample220112-ktxj2acacl
SHA256 50c81d130e719ea4d1f5cf0d682c76bd1db7778dde3c8347d18f55bcdafaa73f
MD5 87f8b24a296aba8f3ec16ea107291aee
SHA1 c4a9c0feeac67e4e58c382fb0297a4812cc9099c
SHA512 63e2096faa77ddcc9dd4211c9604579e90889413ce4a8bf26a38a91b2d96aacfc2b42af57fa11707aa2100df26d41581e398368cfd3b247fbe09911232400dd9
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

79.134.225.115:1024

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 5 IoCs

rat

resource	yara_rule
behavioral2/memory/3576-126-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3576-127-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/3576-128-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1156-396-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral2/memory/1156-398-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
2916	windows updaters.exe
1156	windows updaters.exe

Sets DLL path for service in the registry 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	87f8b24a296aba8f3ec16ea107291aee.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	87f8b24a296aba8f3ec16ea107291aee.exe

Loads dropped DLL 1 IoCs

pid	Process
1996	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\windows update = "C:\\ProgramData\\windows updaters.exe"	87f8b24a296aba8f3ec16ea107291aee.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	windows updaters.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	windows updaters.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\hHKGwrC = "0"	windows updaters.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	windows updaters.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	windows updaters.exe
File opened for modification	C:\Windows\System32\rfxvmt.dll	windows updaters.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2796 set thread context of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2916 set thread context of 1156	2916	windows updaters.exe	77

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	windows updaters.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	windows updaters.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	87f8b24a296aba8f3ec16ea107291aee.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2796	87f8b24a296aba8f3ec16ea107291aee.exe
2796	87f8b24a296aba8f3ec16ea107291aee.exe
2796	87f8b24a296aba8f3ec16ea107291aee.exe
2796	87f8b24a296aba8f3ec16ea107291aee.exe
3436	powershell.exe
3436	powershell.exe
3436	powershell.exe
1416	powershell.exe
1416	powershell.exe
1416	powershell.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe
1996	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
628	Process not Found

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	87f8b24a296aba8f3ec16ea107291aee.exe
Token: SeDebugPrivilege	3436	powershell.exe
Token: SeDebugPrivilege	1416	powershell.exe
Token: SeDebugPrivilege	1156	windows updaters.exe
Token: SeAuditPrivilege	1996	svchost.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1156	windows updaters.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 1936	2796	87f8b24a296aba8f3ec16ea107291aee.exe	69
PID 2796 wrote to memory of 1936	2796	87f8b24a296aba8f3ec16ea107291aee.exe	69
PID 2796 wrote to memory of 1936	2796	87f8b24a296aba8f3ec16ea107291aee.exe	69
PID 2796 wrote to memory of 3284	2796	87f8b24a296aba8f3ec16ea107291aee.exe	70
PID 2796 wrote to memory of 3284	2796	87f8b24a296aba8f3ec16ea107291aee.exe	70
PID 2796 wrote to memory of 3284	2796	87f8b24a296aba8f3ec16ea107291aee.exe	70
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 2796 wrote to memory of 3576	2796	87f8b24a296aba8f3ec16ea107291aee.exe	71
PID 3576 wrote to memory of 3436	3576	87f8b24a296aba8f3ec16ea107291aee.exe	72
PID 3576 wrote to memory of 3436	3576	87f8b24a296aba8f3ec16ea107291aee.exe	72
PID 3576 wrote to memory of 3436	3576	87f8b24a296aba8f3ec16ea107291aee.exe	72
PID 3576 wrote to memory of 2916	3576	87f8b24a296aba8f3ec16ea107291aee.exe	74
PID 3576 wrote to memory of 2916	3576	87f8b24a296aba8f3ec16ea107291aee.exe	74
PID 3576 wrote to memory of 2916	3576	87f8b24a296aba8f3ec16ea107291aee.exe	74
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 2916 wrote to memory of 1156	2916	windows updaters.exe	77
PID 1156 wrote to memory of 1416	1156	windows updaters.exe	78
PID 1156 wrote to memory of 1416	1156	windows updaters.exe	78
PID 1156 wrote to memory of 1416	1156	windows updaters.exe	78
PID 1156 wrote to memory of 1448	1156	windows updaters.exe	80
PID 1156 wrote to memory of 1448	1156	windows updaters.exe	80
PID 1156 wrote to memory of 1448	1156	windows updaters.exe	80
PID 1156 wrote to memory of 1448	1156	windows updaters.exe	80
PID 1156 wrote to memory of 1448	1156	windows updaters.exe	80

C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe
"C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe
  "C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe"
  2⤵
  PID:1936
- C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe
  "C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe"
  2⤵
  PID:3284
- C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe
  "C:\Users\Admin\AppData\Local\Temp\87f8b24a296aba8f3ec16ea107291aee.exe"
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:3576
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3436
- - C:\ProgramData\windows updaters.exe
    "C:\ProgramData\windows updaters.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2916
  - - C:\ProgramData\windows updaters.exe
      "C:\ProgramData\windows updaters.exe"
      4⤵
      Executes dropped EXE
      Modifies WinLogon
      Drops file in System32 directory
      Drops file in Program Files directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1156
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1416
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:1448

\??\c:\windows\system32\svchost.exe
c:\windows\system32\svchost.exe -k networkservice -s TermService
1⤵
PID:3320

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1156-398-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1416-408-0x00000000075A0000-0x0000000007606000-memory.dmp

Download

memory/1416-405-0x0000000006C70000-0x0000000007298000-memory.dmp

Download

memory/1416-427-0x0000000008E90000-0x0000000008EC3000-memory.dmp

Download

memory/1416-426-0x0000000006C70000-0x0000000007298000-memory.dmp

Download

memory/1416-404-0x00000000041F0000-0x0000000004226000-memory.dmp

Download

memory/1416-406-0x0000000007440000-0x0000000007462000-memory.dmp

Download

memory/1416-407-0x0000000007530000-0x0000000007596000-memory.dmp

Download

memory/1416-416-0x0000000007E30000-0x0000000007EA6000-memory.dmp

Download

memory/1416-414-0x0000000007B20000-0x0000000007B6B000-memory.dmp

Download

memory/1416-410-0x0000000007610000-0x0000000007960000-memory.dmp

Download

memory/1416-413-0x0000000007A50000-0x0000000007A6C000-memory.dmp

Download

memory/1416-409-0x00000000042A0000-0x00000000042A1000-memory.dmp

Download

memory/1416-411-0x00000000042A2000-0x00000000042A3000-memory.dmp

Download

memory/1448-421-0x0000000000380000-0x0000000000381000-memory.dmp

Download

memory/2796-121-0x0000000004D10000-0x0000000004D1E000-memory.dmp

Download

memory/2796-116-0x00000000000D0000-0x0000000000120000-memory.dmp

Download

memory/2796-120-0x0000000004950000-0x000000000495A000-memory.dmp

Download

memory/2796-122-0x0000000006D70000-0x0000000006DBB000-memory.dmp

Download

memory/2796-125-0x0000000007180000-0x00000000071CE000-memory.dmp

Download

memory/2796-123-0x0000000004930000-0x0000000004E2E000-memory.dmp

Download

memory/2796-119-0x00000000049D0000-0x0000000004A62000-memory.dmp

Download

memory/2796-124-0x00000000070E0000-0x000000000717C000-memory.dmp

Download

memory/2796-118-0x0000000004E30000-0x000000000532E000-memory.dmp

Download

memory/2796-117-0x00000000000D0000-0x0000000000120000-memory.dmp

Download

memory/2916-137-0x0000000000560000-0x00000000005B0000-memory.dmp

Download

memory/2916-393-0x00000000070A0000-0x000000000713C000-memory.dmp

Download

memory/2916-136-0x0000000000560000-0x00000000005B0000-memory.dmp

Download

memory/2916-138-0x0000000005260000-0x000000000575E000-memory.dmp

Download

memory/2916-139-0x0000000004E00000-0x0000000004E92000-memory.dmp

Download

memory/2916-140-0x0000000004DE0000-0x0000000004DEA000-memory.dmp

Download

memory/2916-141-0x0000000004D60000-0x000000000525E000-memory.dmp

Download

memory/2916-144-0x0000000005250000-0x000000000525E000-memory.dmp

Download

memory/2916-145-0x0000000006D30000-0x0000000006D7B000-memory.dmp

Download

memory/2916-394-0x0000000007140000-0x000000000718E000-memory.dmp

Download

memory/3436-172-0x000000007E3B0000-0x000000007E3B1000-memory.dmp

Download

memory/3436-147-0x0000000006E42000-0x0000000006E43000-memory.dmp

Download

memory/3436-177-0x0000000009440000-0x00000000094E5000-memory.dmp

Download

memory/3436-178-0x0000000006E43000-0x0000000006E44000-memory.dmp

Download

memory/3436-179-0x0000000009610000-0x00000000096A4000-memory.dmp

Download

memory/3436-372-0x0000000009590000-0x00000000095AA000-memory.dmp

Download

memory/3436-377-0x0000000009590000-0x00000000095AA000-memory.dmp

Download

memory/3436-378-0x0000000009570000-0x0000000009578000-memory.dmp

Download

memory/3436-383-0x0000000009570000-0x0000000009578000-memory.dmp

Download

memory/3436-171-0x00000000091D0000-0x00000000091EE000-memory.dmp

Download

memory/3436-169-0x0000000007290000-0x00000000072DB000-memory.dmp

Download

memory/3436-153-0x0000000007290000-0x00000000072DB000-memory.dmp

Download

memory/3436-152-0x0000000007270000-0x000000000728C000-memory.dmp

Download

memory/3436-151-0x0000000007B20000-0x0000000007E70000-memory.dmp

Download

memory/3436-150-0x0000000007AB0000-0x0000000007B16000-memory.dmp

Download

memory/3436-149-0x0000000007190000-0x00000000071F6000-memory.dmp

Download

memory/3436-148-0x00000000070F0000-0x0000000007112000-memory.dmp

Download

memory/3436-154-0x0000000008200000-0x0000000008276000-memory.dmp

Download

memory/3436-146-0x0000000007480000-0x0000000007AA8000-memory.dmp

Download

memory/3436-170-0x0000000008200000-0x0000000008276000-memory.dmp

Download

memory/3436-168-0x0000000007AB0000-0x0000000007B16000-memory.dmp

Download

memory/3436-143-0x0000000004690000-0x00000000046C6000-memory.dmp

Download

memory/3436-142-0x0000000006E40000-0x0000000006E41000-memory.dmp

Download

memory/3436-166-0x00000000070F0000-0x0000000007112000-memory.dmp

Download

memory/3436-167-0x0000000007190000-0x00000000071F6000-memory.dmp

Download

memory/3436-165-0x0000000009210000-0x0000000009243000-memory.dmp

Download

memory/3436-164-0x0000000009210000-0x0000000009243000-memory.dmp

Download

memory/3436-163-0x0000000007480000-0x0000000007AA8000-memory.dmp

Download

memory/3436-133-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/3436-135-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/3436-155-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

Download

memory/3576-128-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3576-126-0x0000000000400000-0x0000000000554000-memory.dmp

Download