warzonerat | 524898ddc5d913718bd872b30e7bfa2eadd322952f6f26f1c671a9271d57456b

General

Target

File2289.exe
Size

734KB
MD5

81e2134ec12d6342cf59df927e4352d8
SHA1

5c798138ebbdb723a7db9f7cf7d3a3b7cdba9515
SHA256

524898ddc5d913718bd872b30e7bfa2eadd322952f6f26f1c671a9271d57456b
SHA512

3d762d4ac94425d972e45de67aaea0b835393fc43229853484e8065f068dc4963e08b780686a09dcbaf06fa3d3e99880b2ccb43b5f7b89dde4104e4c69ec0db8

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

84.38.132.36:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral1/memory/1980-57-0x00000000002F0000-0x0000000000308000-memory.dmp	net_reactor

Warzone RAT Payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2020-68-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2020-70-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2020-72-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2020-74-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2020-76-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2012-80-0x0000000002700000-0x000000000334A000-memory.dmp	warzonerat
behavioral1/memory/2020-83-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

File2289.exe

description pid process target process

PID 1980 set thread context of 2020 1980 File2289.exe File2289.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

728 2020 WerFault.exe File2289.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

428 schtasks.exe
Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

File2289.exepowershell.exe

pid process

1980 File2289.exe
1980 File2289.exe
1980 File2289.exe
1980 File2289.exe
2012 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

File2289.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1980 File2289.exe
Token: SeDebugPrivilege 2012 powershell.exe

description	pid	process	target process
PID 1980 set thread context of 2020	1980	File2289.exe	File2289.exe

pid	pid_target	process	target process
728	2020	WerFault.exe	File2289.exe

pid	process
428	schtasks.exe

pid	process
1980	File2289.exe
1980	File2289.exe
1980	File2289.exe
1980	File2289.exe
2012	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1980	File2289.exe
Token: SeDebugPrivilege	2012	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

File2289.exeFile2289.exe

description	pid	process	target process
PID 1980 wrote to memory of 2012	1980	File2289.exe	powershell.exe
PID 1980 wrote to memory of 2012	1980	File2289.exe	powershell.exe
PID 1980 wrote to memory of 2012	1980	File2289.exe	powershell.exe
PID 1980 wrote to memory of 2012	1980	File2289.exe	powershell.exe
PID 1980 wrote to memory of 428	1980	File2289.exe	schtasks.exe
PID 1980 wrote to memory of 428	1980	File2289.exe	schtasks.exe
PID 1980 wrote to memory of 428	1980	File2289.exe	schtasks.exe
PID 1980 wrote to memory of 428	1980	File2289.exe	schtasks.exe
PID 1980 wrote to memory of 1792	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 1792	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 1792	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 1792	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 1980 wrote to memory of 2020	1980	File2289.exe	File2289.exe
PID 2020 wrote to memory of 728	2020	File2289.exe	WerFault.exe
PID 2020 wrote to memory of 728	2020	File2289.exe	WerFault.exe
PID 2020 wrote to memory of 728	2020	File2289.exe	WerFault.exe
PID 2020 wrote to memory of 728	2020	File2289.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\File2289.exe
"C:\Users\Admin\AppData\Local\Temp\File2289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kbbhCgmYHd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kbbhCgmYHd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDC6A.tmp"
2⤵
- Creates scheduled task(s)
PID:428

C:\Users\Admin\AppData\Local\Temp\File2289.exe
"C:\Users\Admin\AppData\Local\Temp\File2289.exe"
2⤵
PID:1792

C:\Users\Admin\AppData\Local\Temp\File2289.exe
"C:\Users\Admin\AppData\Local\Temp\File2289.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2020 -s 200
3⤵
- Program crash
PID:728

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpDC6A.tmp
MD5
236f505cb4ed502b29cae281971b63b0

SHA1
25a4d3b76cb746e0c2f7ff15d259f02c58b5511b

SHA256
bf85996d5cc227417b79ed6e9f0cd27e61f50a21308a3db990ae5803e954ff39

SHA512
7c987436c97fde3e6bc758c8f245c0156fdfce008323acb794495e1f8e2551e7c2891b88d1b9da0cb0e4276a38cf1e9ce320e398006c502e070a02382f507806

Download Submit
memory/1980-61-0x0000000004530000-0x0000000004552000-memory.dmp

Filesize
136KB

Download
memory/1980-55-0x00000000740C0000-0x00000000747AE000-memory.dmp

Filesize
6.9MB

Download
memory/1980-56-0x0000000000420000-0x0000000000421000-memory.dmp

Filesize
4KB

Download
memory/1980-57-0x00000000002F0000-0x0000000000308000-memory.dmp

Filesize
96KB

Download
memory/1980-58-0x00000000057E0000-0x0000000005882000-memory.dmp

Filesize
648KB

Download
memory/1980-54-0x0000000000170000-0x000000000022E000-memory.dmp

Filesize
760KB

Download
memory/2012-78-0x000000006E450000-0x000000006E9FB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-59-0x0000000074C61000-0x0000000074C63000-memory.dmp

Filesize
8KB

Download
memory/2012-84-0x0000000002700000-0x000000000334A000-memory.dmp

Filesize
12.3MB

Download
memory/2012-81-0x0000000002700000-0x000000000334A000-memory.dmp

Filesize
12.3MB

Download
memory/2012-82-0x000000006E450000-0x000000006E9FB000-memory.dmp

Filesize
5.7MB

Download
memory/2012-80-0x0000000002700000-0x000000000334A000-memory.dmp

Filesize
12.3MB

Download
memory/2020-68-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-74-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-72-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-76-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-70-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-83-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-62-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-66-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2020-64-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads