warzonerat | 5a2d9ae36c3424f8de4fee3af5ba038b0e12c2d3bb3a67a576cd54a7553206e6

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220331-en
submitted
09/04/2022, 10:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Order105725357.exe
Size 613KB
Sample220409-mh78hadgap
SHA256 5a2d9ae36c3424f8de4fee3af5ba038b0e12c2d3bb3a67a576cd54a7553206e6
MD5 c952d3a322706e4e30c64cd6c84a92fc
SHA1 8fe4b5b50cc54633493b816f167610ecafccc6df
SHA512 a579bb0028b6b3d7e55abed524ce7d83d043aace8c82eaebe094263a14b3f18ac74c8eb5e58f3a190f694341bae052cdfede3ae55944c3de2869e31960ada529
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

5.2.68.67:1198

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/4204-138-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4204-140-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1082102374-1487407228-1886994731-1000\Control Panel\International\Geo\Nation	Order105725357.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5104 set thread context of 4204	5104	Order105725357.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3108	4204	WerFault.exe	100

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2240	schtasks.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
5104	Order105725357.exe
2624	powershell.exe
2624	powershell.exe
2624	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	Order105725357.exe
Token: SeDebugPrivilege	2624	powershell.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2624	5104	Order105725357.exe	94
PID 5104 wrote to memory of 2624	5104	Order105725357.exe	94
PID 5104 wrote to memory of 2624	5104	Order105725357.exe	94
PID 5104 wrote to memory of 2240	5104	Order105725357.exe	96
PID 5104 wrote to memory of 2240	5104	Order105725357.exe	96
PID 5104 wrote to memory of 2240	5104	Order105725357.exe	96
PID 5104 wrote to memory of 3860	5104	Order105725357.exe	98
PID 5104 wrote to memory of 3860	5104	Order105725357.exe	98
PID 5104 wrote to memory of 3860	5104	Order105725357.exe	98
PID 5104 wrote to memory of 1396	5104	Order105725357.exe	99
PID 5104 wrote to memory of 1396	5104	Order105725357.exe	99
PID 5104 wrote to memory of 1396	5104	Order105725357.exe	99
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100
PID 5104 wrote to memory of 4204	5104	Order105725357.exe	100

C:\Users\Admin\AppData\Local\Temp\Order105725357.exe
"C:\Users\Admin\AppData\Local\Temp\Order105725357.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ucFGhy.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2624
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ucFGhy" /XML "C:\Users\Admin\AppData\Local\Temp\tmp157C.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\Order105725357.exe
  "C:\Users\Admin\AppData\Local\Temp\Order105725357.exe"
  2⤵
  PID:3860
- C:\Users\Admin\AppData\Local\Temp\Order105725357.exe
  "C:\Users\Admin\AppData\Local\Temp\Order105725357.exe"
  2⤵
  PID:1396
- C:\Users\Admin\AppData\Local\Temp\Order105725357.exe
  "C:\Users\Admin\AppData\Local\Temp\Order105725357.exe"
  2⤵
  PID:4204
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4204 -s 520
    3⤵
    - Program crash
    PID:3108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4204 -ip 4204
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp157C.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmp157C.tmp
Size 1KB
SHA256 dd9d7767475b59bfa02540ab147761646571bf88b0f17aa26fdb21f7530ee96d
MD5 4ce6984a5968d47f4dad801690d100c7
SHA1 c7351f065bfea08e4b9e64f842eec9e1f487e4d6
SHA512 949287ca0d3180cf782211063a7cfda6ba36be0dc3dff0b55043739422961dc989c34dae44aa1a7b4ac580cfa273321e5308d9e1b43f24571ab7bf9bda9a0f56
MD5 SHA1 SHA512

Submit Download

memory/2624-146-0x0000000006470000-0x000000000648E000-memory.dmp

Download

memory/2624-148-0x0000000007810000-0x0000000007E8A000-memory.dmp

Download

memory/2624-154-0x00000000074F0000-0x00000000074F8000-memory.dmp

Download

memory/2624-153-0x0000000007510000-0x000000000752A000-memory.dmp

Download

memory/2624-132-0x0000000000DA0000-0x0000000000DD6000-memory.dmp

Download

memory/2624-152-0x0000000007400000-0x000000000740E000-memory.dmp

Download

memory/2624-151-0x0000000007450000-0x00000000074E6000-memory.dmp

Download

memory/2624-150-0x0000000007240000-0x000000000724A000-memory.dmp

Download

memory/2624-149-0x00000000071D0000-0x00000000071EA000-memory.dmp

Download

memory/2624-136-0x0000000005070000-0x0000000005698000-memory.dmp

Download

memory/2624-147-0x0000000004A35000-0x0000000004A37000-memory.dmp

Download

memory/2624-145-0x0000000070380000-0x00000000703CC000-memory.dmp

Download

memory/2624-141-0x0000000005010000-0x0000000005032000-memory.dmp

Download

memory/2624-142-0x0000000005810000-0x0000000005876000-memory.dmp

Download

memory/2624-143-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

Download

memory/2624-144-0x0000000006490000-0x00000000064C2000-memory.dmp

Download

memory/4204-140-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4204-138-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/5104-124-0x0000000000290000-0x0000000000330000-memory.dmp

Download

memory/5104-128-0x0000000004CC0000-0x0000000004CCA000-memory.dmp

Download

memory/5104-125-0x00000000052D0000-0x0000000005874000-memory.dmp

Download

memory/5104-126-0x0000000004D20000-0x0000000004DB2000-memory.dmp

Download

memory/5104-127-0x0000000004DC0000-0x0000000004E5C000-memory.dmp

Download

memory/5104-129-0x0000000007780000-0x00000000077E6000-memory.dmp

Download