warzonerat | 76389098be8a410aaf6b21297912f6ef745db6e8a2f2aaaddda8685bd91091c3

Resubmissions

31/01/2022, 17:50

220131-wepresbbd210

27/01/2022, 13:45

220127-q2ebbadfbk10

Analysis

max time kernel
122s
max time network
146s
platform
windows7_x64
resource
win7-en-20211208
submitted
27/01/2022, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
oxc.exe
Size 664KB
Sample220127-q2ebbadfbk
SHA256 76389098be8a410aaf6b21297912f6ef745db6e8a2f2aaaddda8685bd91091c3
MD5 1d470425e6e769759432b129e3d1e953
SHA1 092e76ca81792d780c26c7842fd3fc33eb157df9
SHA512 f346784661b69cc72a57d5fb9694c37e947725574f0ac19db5c21c739ca6a718307afb053694859482d282e9d100d2e1bdc19e194cc2380f753502ecb8e0a135
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

152.67.253.163:5300

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1836-97-0x0000000001FC0000-0x0000000002114000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
1952	ComputerDefaults.exe
1712	ComputerDefaults.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dkmbwcpqlj = "C:\\Users\\Admin\\Contacts\\jlqpcwbmkD.url"	oxc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
880	PING.EXE

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1836	1116	oxc.exe	31
PID 1116 wrote to memory of 1948	1116	oxc.exe	32
PID 1116 wrote to memory of 1948	1116	oxc.exe	32
PID 1116 wrote to memory of 1948	1116	oxc.exe	32
PID 1116 wrote to memory of 1948	1116	oxc.exe	32
PID 1948 wrote to memory of 1660	1948	cmd.exe	34
PID 1948 wrote to memory of 1660	1948	cmd.exe	34
PID 1948 wrote to memory of 1660	1948	cmd.exe	34
PID 1948 wrote to memory of 1660	1948	cmd.exe	34
PID 1660 wrote to memory of 880	1660	cmd.exe	38
PID 1660 wrote to memory of 880	1660	cmd.exe	38
PID 1660 wrote to memory of 880	1660	cmd.exe	38
PID 1660 wrote to memory of 880	1660	cmd.exe	38

C:\Users\Admin\AppData\Local\Temp\oxc.exe
"C:\Users\Admin\AppData\Local\Temp\oxc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:1836
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\Contacts\Dkmbwcpqljt.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1948
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Admin\Contacts\DkmbwcpqljO.bat
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1660
  - - C:\Windows \System32\ComputerDefaults.exe
      "C:\Windows \System32\ComputerDefaults.exe"
      4⤵
      Executes dropped EXE
      PID:1952
  - - C:\Windows \System32\ComputerDefaults.exe
      "C:\Windows \System32\ComputerDefaults.exe"
      4⤵
      Executes dropped EXE
      PID:1712
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 6
      4⤵
      Runs ping.exe
      PID:880

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1116-56-0x0000000076511000-0x0000000076513000-memory.dmp

Download

memory/1116-55-0x0000000000330000-0x0000000000331000-memory.dmp

Download

memory/1660-99-0x0000000002150000-0x0000000002245000-memory.dmp

Download

memory/1836-82-0x00000000726E0000-0x0000000072836000-memory.dmp

Download

memory/1836-72-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

memory/1836-87-0x00000000000E0000-0x00000000000E1000-memory.dmp

Download

memory/1836-89-0x00000000726E0000-0x0000000072836000-memory.dmp

Download

memory/1836-88-0x0000000000220000-0x0000000000221000-memory.dmp

Download

memory/1836-97-0x0000000001FC0000-0x0000000002114000-memory.dmp

Download

memory/1836-86-0x00000000000C0000-0x00000000000C1000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads