warzonerat | 524898ddc5d913718bd872b30e7bfa2eadd322952f6f26f1c671a9271d57456b

General

Target

File2289.exe
Size

734KB
MD5

81e2134ec12d6342cf59df927e4352d8
SHA1

5c798138ebbdb723a7db9f7cf7d3a3b7cdba9515
SHA256

524898ddc5d913718bd872b30e7bfa2eadd322952f6f26f1c671a9271d57456b
SHA512

3d762d4ac94425d972e45de67aaea0b835393fc43229853484e8065f068dc4963e08b780686a09dcbaf06fa3d3e99880b2ccb43b5f7b89dde4104e4c69ec0db8

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

84.38.132.36:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

.NET Reactor proctector 1 IoCs

Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.

Processes:

resource	yara_rule
behavioral2/memory/2452-124-0x00000000054B0000-0x00000000054C8000-memory.dmp	net_reactor

Warzone RAT Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/524-132-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/524-135-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

File2289.exe

description pid process target process

PID 2452 set thread context of 524 2452 File2289.exe File2289.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

192 524 WerFault.exe File2289.exe
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

656 schtasks.exe
Suspicious behavior: EnumeratesProcesses 7 IoCs

Processes:

File2289.exepowershell.exe

pid process

2452 File2289.exe
2452 File2289.exe
2452 File2289.exe
2452 File2289.exe
1296 powershell.exe
1296 powershell.exe
1296 powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

File2289.exepowershell.exe

description pid process

Token: SeDebugPrivilege 2452 File2289.exe
Token: SeDebugPrivilege 1296 powershell.exe

description	pid	process	target process
PID 2452 set thread context of 524	2452	File2289.exe	File2289.exe

pid	pid_target	process	target process
192	524	WerFault.exe	File2289.exe

pid	process
656	schtasks.exe

pid	process
2452	File2289.exe
2452	File2289.exe
2452	File2289.exe
2452	File2289.exe
1296	powershell.exe
1296	powershell.exe
1296	powershell.exe

description	pid	process
Token: SeDebugPrivilege	2452	File2289.exe
Token: SeDebugPrivilege	1296	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

File2289.exe

description	pid	process	target process
PID 2452 wrote to memory of 1296	2452	File2289.exe	powershell.exe
PID 2452 wrote to memory of 1296	2452	File2289.exe	powershell.exe
PID 2452 wrote to memory of 1296	2452	File2289.exe	powershell.exe
PID 2452 wrote to memory of 656	2452	File2289.exe	schtasks.exe
PID 2452 wrote to memory of 656	2452	File2289.exe	schtasks.exe
PID 2452 wrote to memory of 656	2452	File2289.exe	schtasks.exe
PID 2452 wrote to memory of 528	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 528	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 528	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe
PID 2452 wrote to memory of 524	2452	File2289.exe	File2289.exe

C:\Users\Admin\AppData\Local\Temp\File2289.exe
"C:\Users\Admin\AppData\Local\Temp\File2289.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\kbbhCgmYHd.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1296

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\kbbhCgmYHd" /XML "C:\Users\Admin\AppData\Local\Temp\tmpED7A.tmp"
2⤵
- Creates scheduled task(s)
PID:656

C:\Users\Admin\AppData\Local\Temp\File2289.exe
"C:\Users\Admin\AppData\Local\Temp\File2289.exe"
2⤵
PID:528

C:\Users\Admin\AppData\Local\Temp\File2289.exe
"C:\Users\Admin\AppData\Local\Temp\File2289.exe"
2⤵
PID:524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 524 -s 536
3⤵
- Program crash
PID:192

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpED7A.tmp
MD5
339144a4ac3c24ffd7932735eaa29c1b

SHA1
67eb56407794f1afa84dd28ceb07c4cad2cfc6a5

SHA256
0d508b18c00a78bb6202b69f163222caf605adf856b439d8b68ffb185f133225

SHA512
aca0d0f97b121411d01dbdf751d42c3946c068e854666850e16ce1244362e188b32239f654b35b95d7d6d4b0b61839ed31ab106c73f1e9ceb80b8332e16a6285

Download Submit
memory/524-135-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/524-132-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1296-145-0x0000000008B30000-0x0000000008BA6000-memory.dmp

Filesize
472KB

Download
memory/1296-133-0x0000000007D10000-0x0000000008338000-memory.dmp

Filesize
6.2MB

Download
memory/1296-138-0x0000000007B90000-0x0000000007BF6000-memory.dmp

Filesize
408KB

Download
memory/1296-139-0x00000000076D0000-0x00000000076D1000-memory.dmp

Filesize
4KB

Download
memory/1296-356-0x0000000009E20000-0x0000000009E3A000-memory.dmp

Filesize
104KB

Download
memory/1296-231-0x00000000076D3000-0x00000000076D4000-memory.dmp

Filesize
4KB

Download
memory/1296-162-0x0000000009E80000-0x0000000009F14000-memory.dmp

Filesize
592KB

Download
memory/1296-130-0x0000000004F70000-0x0000000004FA6000-memory.dmp

Filesize
216KB

Download
memory/1296-161-0x000000007E8F0000-0x000000007E8F1000-memory.dmp

Filesize
4KB

Download
memory/1296-144-0x0000000008810000-0x000000000885B000-memory.dmp

Filesize
300KB

Download
memory/1296-160-0x0000000009CC0000-0x0000000009D65000-memory.dmp

Filesize
660KB

Download
memory/1296-155-0x0000000009B50000-0x0000000009B6E000-memory.dmp

Filesize
120KB

Download
memory/1296-136-0x0000000007A10000-0x0000000007A32000-memory.dmp

Filesize
136KB

Download
memory/1296-137-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/1296-361-0x0000000009E10000-0x0000000009E18000-memory.dmp

Filesize
32KB

Download
memory/1296-154-0x0000000009B90000-0x0000000009BC3000-memory.dmp

Filesize
204KB

Download
memory/1296-140-0x00000000076D2000-0x00000000076D3000-memory.dmp

Filesize
4KB

Download
memory/1296-141-0x0000000007AB0000-0x0000000007B16000-memory.dmp

Filesize
408KB

Download
memory/1296-142-0x0000000008340000-0x0000000008690000-memory.dmp

Filesize
3.3MB

Download
memory/1296-143-0x0000000008690000-0x00000000086AC000-memory.dmp

Filesize
112KB

Download
memory/2452-131-0x0000000007D10000-0x0000000007D32000-memory.dmp

Filesize
136KB

Download
memory/2452-118-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/2452-123-0x0000000005250000-0x000000000525A000-memory.dmp

Filesize
40KB

Download
memory/2452-119-0x0000000000820000-0x00000000008DE000-memory.dmp

Filesize
760KB

Download
memory/2452-120-0x00000000056E0000-0x0000000005BDE000-memory.dmp

Filesize
5.0MB

Download
memory/2452-122-0x00000000051E0000-0x00000000056DE000-memory.dmp

Filesize
5.0MB

Download
memory/2452-121-0x0000000005280000-0x0000000005312000-memory.dmp

Filesize
584KB

Download
memory/2452-126-0x0000000007C20000-0x0000000007CC2000-memory.dmp

Filesize
648KB

Download
memory/2452-125-0x0000000007A20000-0x0000000007ABC000-memory.dmp

Filesize
624KB

Download
memory/2452-124-0x00000000054B0000-0x00000000054C8000-memory.dmp

Filesize
96KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads