warzonerat | 672ae14fc78158bc3a5b44c20488600a02e54a9d9231420a343885ab7e1c8f4f

General

Target

4SgcpBifNVPbGl6.exe
Size

966KB
MD5

fbe792df5474f73a0b287a21ae093337
SHA1

9b9f41e121439f09ceef0d6e8d640f63a2433606
SHA256

672ae14fc78158bc3a5b44c20488600a02e54a9d9231420a343885ab7e1c8f4f
SHA512

7bb9527211da305efaecd75f02dad41e6c8daffc4b94d09c6af85ab03bc0d4af76dc8ef7383637f534468d32ce06e17893757d7c1ffacbaf4b43787bc450703f

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

103.125.189.167:1998

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1380-66-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1380-68-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1380-70-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1380-72-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1380-74-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1380-77-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

4SgcpBifNVPbGl6.exe

description pid process target process

PID 1676 set thread context of 1380 1676 4SgcpBifNVPbGl6.exe 4SgcpBifNVPbGl6.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

584 1380 WerFault.exe 4SgcpBifNVPbGl6.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

4SgcpBifNVPbGl6.exe

pid process

1676 4SgcpBifNVPbGl6.exe
1676 4SgcpBifNVPbGl6.exe
1676 4SgcpBifNVPbGl6.exe
1676 4SgcpBifNVPbGl6.exe
1676 4SgcpBifNVPbGl6.exe
1676 4SgcpBifNVPbGl6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4SgcpBifNVPbGl6.exe

description pid process

Token: SeDebugPrivilege 1676 4SgcpBifNVPbGl6.exe

description	pid	process	target process
PID 1676 set thread context of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe

pid	pid_target	process	target process
584	1380	WerFault.exe	4SgcpBifNVPbGl6.exe

pid	process
1676	4SgcpBifNVPbGl6.exe
1676	4SgcpBifNVPbGl6.exe
1676	4SgcpBifNVPbGl6.exe
1676	4SgcpBifNVPbGl6.exe
1676	4SgcpBifNVPbGl6.exe
1676	4SgcpBifNVPbGl6.exe

description	pid	process
Token: SeDebugPrivilege	1676	4SgcpBifNVPbGl6.exe

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

4SgcpBifNVPbGl6.exe4SgcpBifNVPbGl6.exe

description	pid	process	target process
PID 1676 wrote to memory of 1624	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1624	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1624	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1624	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1812	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1812	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1812	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1812	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1676 wrote to memory of 1380	1676	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 1380 wrote to memory of 584	1380	4SgcpBifNVPbGl6.exe	WerFault.exe
PID 1380 wrote to memory of 584	1380	4SgcpBifNVPbGl6.exe	WerFault.exe
PID 1380 wrote to memory of 584	1380	4SgcpBifNVPbGl6.exe	WerFault.exe
PID 1380 wrote to memory of 584	1380	4SgcpBifNVPbGl6.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe
"C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676

C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe
"C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe"
2⤵
PID:1624

C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe
"C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe"
2⤵
PID:1812

C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe
"C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:1380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1380 -s 200
3⤵
- Program crash
PID:584

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1380-72-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-60-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-77-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-76-0x0000000076361000-0x0000000076363000-memory.dmp

Filesize
8KB

Download
memory/1380-64-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-74-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-70-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-62-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-68-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1380-66-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1676-58-0x00000000056F0000-0x00000000057DC000-memory.dmp

Filesize
944KB

Download
memory/1676-55-0x00000000002D0000-0x00000000003CA000-memory.dmp

Filesize
1000KB

Download
memory/1676-54-0x00000000746A0000-0x0000000074D8E000-memory.dmp

Filesize
6.9MB

Download
memory/1676-59-0x0000000001F00000-0x0000000001F22000-memory.dmp

Filesize
136KB

Download
memory/1676-57-0x0000000000440000-0x0000000000458000-memory.dmp

Filesize
96KB

Download
memory/1676-56-0x0000000004F40000-0x0000000004F41000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads