warzonerat | c7b9caa8ed91068cdc627c8e72f9ecb6f71d4c99b16e930d4875bc283bb25529

Analysis

max time kernel
140s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
10/02/2022, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PURCHASE ORDER 10.02.2022.exe
Size 796KB
Sample220210-ssftwshbdj
SHA256 c7b9caa8ed91068cdc627c8e72f9ecb6f71d4c99b16e930d4875bc283bb25529
MD5 72b618df5aa71477f0ce5ad875e982f1
SHA1 ed40c070e0c1bb11bea2b013bb30c267c77dcdc9
SHA512 1220368b2d5ede57f980cbe4366fa2b5c97aeeef0e6378beb547978413af31de6581e076f523529dfde92aa8d6c17a6cec3db0288298d3d7a5274322a4c8aa2f
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

2x5v.2p.fm:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 2 IoCs

pid	Process
1176	images.exe
1152	images.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	PURCHASE ORDER 10.02.2022.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	images.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4328 set thread context of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 1176 set thread context of 1152	1176	images.exe	113

Drops file in Windows directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\WinSxS\pending.xml	TiWorker.exe
File opened for modification	C:\Windows\WindowsUpdate.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.edb	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm	svchost.exe
File opened for modification	C:\Windows\SoftwareDistribution\ReportingEvents.log	svchost.exe
File opened for modification	C:\Windows\Logs\CBS\CBS.log	TiWorker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4328	PURCHASE ORDER 10.02.2022.exe
4324	powershell.exe
4324	powershell.exe
1176	images.exe
1176	images.exe
1176	images.exe
1176	images.exe
1176	images.exe
1176	images.exe
1176	images.exe
1176	images.exe
1176	images.exe
4152	powershell.exe
4152	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2932	svchost.exe
Token: SeCreatePagefilePrivilege	2932	svchost.exe
Token: SeShutdownPrivilege	2932	svchost.exe
Token: SeCreatePagefilePrivilege	2932	svchost.exe
Token: SeShutdownPrivilege	2932	svchost.exe
Token: SeCreatePagefilePrivilege	2932	svchost.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe
Token: SeRestorePrivilege	680	TiWorker.exe
Token: SeSecurityPrivilege	680	TiWorker.exe
Token: SeBackupPrivilege	680	TiWorker.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 4324	4328	PURCHASE ORDER 10.02.2022.exe	100
PID 4328 wrote to memory of 4324	4328	PURCHASE ORDER 10.02.2022.exe	100
PID 4328 wrote to memory of 4324	4328	PURCHASE ORDER 10.02.2022.exe	100
PID 4328 wrote to memory of 1652	4328	PURCHASE ORDER 10.02.2022.exe	102
PID 4328 wrote to memory of 1652	4328	PURCHASE ORDER 10.02.2022.exe	102
PID 4328 wrote to memory of 1652	4328	PURCHASE ORDER 10.02.2022.exe	102
PID 4328 wrote to memory of 4028	4328	PURCHASE ORDER 10.02.2022.exe	103
PID 4328 wrote to memory of 4028	4328	PURCHASE ORDER 10.02.2022.exe	103
PID 4328 wrote to memory of 4028	4328	PURCHASE ORDER 10.02.2022.exe	103
PID 4328 wrote to memory of 4032	4328	PURCHASE ORDER 10.02.2022.exe	104
PID 4328 wrote to memory of 4032	4328	PURCHASE ORDER 10.02.2022.exe	104
PID 4328 wrote to memory of 4032	4328	PURCHASE ORDER 10.02.2022.exe	104
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4328 wrote to memory of 4036	4328	PURCHASE ORDER 10.02.2022.exe	105
PID 4036 wrote to memory of 3948	4036	PURCHASE ORDER 10.02.2022.exe	106
PID 4036 wrote to memory of 3948	4036	PURCHASE ORDER 10.02.2022.exe	106
PID 4036 wrote to memory of 3948	4036	PURCHASE ORDER 10.02.2022.exe	106
PID 4036 wrote to memory of 1176	4036	PURCHASE ORDER 10.02.2022.exe	108
PID 4036 wrote to memory of 1176	4036	PURCHASE ORDER 10.02.2022.exe	108
PID 4036 wrote to memory of 1176	4036	PURCHASE ORDER 10.02.2022.exe	108
PID 3948 wrote to memory of 2984	3948	cmd.exe	109
PID 3948 wrote to memory of 2984	3948	cmd.exe	109
PID 3948 wrote to memory of 2984	3948	cmd.exe	109
PID 1176 wrote to memory of 4152	1176	images.exe	111
PID 1176 wrote to memory of 4152	1176	images.exe	111
PID 1176 wrote to memory of 4152	1176	images.exe	111
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1176 wrote to memory of 1152	1176	images.exe	113
PID 1152 wrote to memory of 4300	1152	images.exe	114
PID 1152 wrote to memory of 4300	1152	images.exe	114
PID 1152 wrote to memory of 4300	1152	images.exe	114
PID 1152 wrote to memory of 4300	1152	images.exe	114
PID 1152 wrote to memory of 4300	1152	images.exe	114

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe"
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe"
  2⤵
  PID:4028
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe"
  2⤵
  PID:4032
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER 10.02.2022.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3948
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
      4⤵
      PID:2984
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1176
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\ProgramData\images.exe"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4152
  - - C:\ProgramData\images.exe
      "C:\ProgramData\images.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1152
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:4300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2932

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:680

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-171-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1176-153-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/1176-154-0x00000000050C0000-0x00000000050C1000-memory.dmp

Download

memory/2932-136-0x0000015FBE190000-0x0000015FBE1A0000-memory.dmp

Download

memory/2932-137-0x0000015FBE720000-0x0000015FBE730000-memory.dmp

Download

memory/2932-138-0x0000015FC0E10000-0x0000015FC0E14000-memory.dmp

Download

memory/4036-143-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4036-140-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4152-172-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/4152-173-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/4152-174-0x0000000000D72000-0x0000000000D73000-memory.dmp

Download

memory/4152-175-0x00000000716F0000-0x000000007173C000-memory.dmp

Download

memory/4152-177-0x000000007FB10000-0x000000007FB11000-memory.dmp

Download

memory/4152-176-0x0000000000D75000-0x0000000000D77000-memory.dmp

Download

memory/4300-178-0x0000000000F30000-0x0000000000F31000-memory.dmp

Download

memory/4324-142-0x00000000058D0000-0x0000000005EF8000-memory.dmp

Download

memory/4324-163-0x0000000007840000-0x00000000078D6000-memory.dmp

Download

memory/4324-149-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/4324-148-0x00000000055B0000-0x0000000005616000-memory.dmp

Download

memory/4324-147-0x0000000005410000-0x0000000005432000-memory.dmp

Download

memory/4324-155-0x0000000001095000-0x0000000001097000-memory.dmp

Download

memory/4324-156-0x0000000006890000-0x00000000068C2000-memory.dmp

Download

memory/4324-157-0x0000000070FA0000-0x0000000070FEC000-memory.dmp

Download

memory/4324-158-0x0000000006870000-0x000000000688E000-memory.dmp

Download

memory/4324-159-0x0000000007C00000-0x000000000827A000-memory.dmp

Download

memory/4324-160-0x00000000075C0000-0x00000000075DA000-memory.dmp

Download

memory/4324-161-0x000000007F3E0000-0x000000007F3E1000-memory.dmp

Download

memory/4324-162-0x0000000007630000-0x000000000763A000-memory.dmp

Download

memory/4324-150-0x00000000062C0000-0x00000000062DE000-memory.dmp

Download

memory/4324-164-0x00000000077F0000-0x00000000077FE000-memory.dmp

Download

memory/4324-165-0x0000000007900000-0x000000000791A000-memory.dmp

Download

memory/4324-166-0x00000000078E0000-0x00000000078E8000-memory.dmp

Download

memory/4324-146-0x0000000001092000-0x0000000001093000-memory.dmp

Download

memory/4324-145-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/4324-144-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/4324-141-0x00000000029A0000-0x00000000029D6000-memory.dmp

Download

memory/4328-130-0x0000000000870000-0x000000000093E000-memory.dmp

Download

memory/4328-139-0x0000000007680000-0x000000000771C000-memory.dmp

Download

memory/4328-135-0x00000000054F0000-0x00000000054F1000-memory.dmp

Download

memory/4328-134-0x00000000051E0000-0x00000000051EA000-memory.dmp

Download

memory/4328-133-0x0000000074D4E000-0x0000000074D4F000-memory.dmp

Download

memory/4328-132-0x0000000005240000-0x00000000052D2000-memory.dmp

Download

memory/4328-131-0x00000000058F0000-0x0000000005E94000-memory.dmp

Download