warzonerat | 39b1cd448c4ef2526f355b4d2865e5d76aa3e79cdd45895066156061ee3ecedf

Analysis

max time kernel
118s
max time network
45s
platform
windows7_x64
resource
win7-20220414-en
submitted
21/04/2022, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ORDER-MVTOLEDO TRIUMPH.exe
Size 506KB
Sample220421-netrdaafcq
SHA256 39b1cd448c4ef2526f355b4d2865e5d76aa3e79cdd45895066156061ee3ecedf
MD5 1afb689a5aac9a249b9c43d18d3eb5f1
SHA1 5f0e5d8eadb26a3fc2d3e54583bd8414c66eabe8
SHA512 932c84da053571dbe41516db707a3681212ce34e8770984649b35bfa06473d420f30296930337b87508c3776546b50c119851c4629b88aa683096e1e9369655f
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

76.8.53.133:1198

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 1 IoCs

pid	Process
1232	windowsupdate.exe

Loads dropped DLL 1 IoCs

pid	Process
584	ORDER-MVTOLEDO TRIUMPH.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1580 set thread context of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
2008	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1580	ORDER-MVTOLEDO TRIUMPH.exe
1580	ORDER-MVTOLEDO TRIUMPH.exe
1580	ORDER-MVTOLEDO TRIUMPH.exe
1580	ORDER-MVTOLEDO TRIUMPH.exe
1580	ORDER-MVTOLEDO TRIUMPH.exe
1580	ORDER-MVTOLEDO TRIUMPH.exe
1204	powershell.exe
1928	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1580	ORDER-MVTOLEDO TRIUMPH.exe
Token: SeDebugPrivilege	1204	powershell.exe
Token: SeDebugPrivilege	1928	powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1204	1580	ORDER-MVTOLEDO TRIUMPH.exe	28
PID 1580 wrote to memory of 1204	1580	ORDER-MVTOLEDO TRIUMPH.exe	28
PID 1580 wrote to memory of 1204	1580	ORDER-MVTOLEDO TRIUMPH.exe	28
PID 1580 wrote to memory of 1204	1580	ORDER-MVTOLEDO TRIUMPH.exe	28
PID 1580 wrote to memory of 2008	1580	ORDER-MVTOLEDO TRIUMPH.exe	30
PID 1580 wrote to memory of 2008	1580	ORDER-MVTOLEDO TRIUMPH.exe	30
PID 1580 wrote to memory of 2008	1580	ORDER-MVTOLEDO TRIUMPH.exe	30
PID 1580 wrote to memory of 2008	1580	ORDER-MVTOLEDO TRIUMPH.exe	30
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 1580 wrote to memory of 584	1580	ORDER-MVTOLEDO TRIUMPH.exe	32
PID 584 wrote to memory of 1928	584	ORDER-MVTOLEDO TRIUMPH.exe	33
PID 584 wrote to memory of 1928	584	ORDER-MVTOLEDO TRIUMPH.exe	33
PID 584 wrote to memory of 1928	584	ORDER-MVTOLEDO TRIUMPH.exe	33
PID 584 wrote to memory of 1928	584	ORDER-MVTOLEDO TRIUMPH.exe	33
PID 584 wrote to memory of 1232	584	ORDER-MVTOLEDO TRIUMPH.exe	34
PID 584 wrote to memory of 1232	584	ORDER-MVTOLEDO TRIUMPH.exe	34
PID 584 wrote to memory of 1232	584	ORDER-MVTOLEDO TRIUMPH.exe	34
PID 584 wrote to memory of 1232	584	ORDER-MVTOLEDO TRIUMPH.exe	34
PID 584 wrote to memory of 1232	584	ORDER-MVTOLEDO TRIUMPH.exe	34
PID 584 wrote to memory of 1232	584	ORDER-MVTOLEDO TRIUMPH.exe	34
PID 584 wrote to memory of 1232	584	ORDER-MVTOLEDO TRIUMPH.exe	34

C:\Users\Admin\AppData\Local\Temp\ORDER-MVTOLEDO TRIUMPH.exe
"C:\Users\Admin\AppData\Local\Temp\ORDER-MVTOLEDO TRIUMPH.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\NVOBwryNw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1204
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\NVOBwryNw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE37D.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2008
- C:\Users\Admin\AppData\Local\Temp\ORDER-MVTOLEDO TRIUMPH.exe
  "C:\Users\Admin\AppData\Local\Temp\ORDER-MVTOLEDO TRIUMPH.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:584
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1928
- - C:\ProgramData\windowsupdate.exe
    "C:\ProgramData\windowsupdate.exe"
    3⤵
    - Executes dropped EXE
    PID:1232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

windowsupdate.exe

Path C:\ProgramData\windowsupdate.exe
Size 506KB
SHA256 39b1cd448c4ef2526f355b4d2865e5d76aa3e79cdd45895066156061ee3ecedf
MD5 1afb689a5aac9a249b9c43d18d3eb5f1
SHA1 5f0e5d8eadb26a3fc2d3e54583bd8414c66eabe8
SHA512 932c84da053571dbe41516db707a3681212ce34e8770984649b35bfa06473d420f30296930337b87508c3776546b50c119851c4629b88aa683096e1e9369655f
SSDEEP 6144:dUBKXaGChqkTzk2E2oIvD5seMisYhd28nPExa0AaAPIls3ueogX/f7M0PxSd9XrZ:oKYzhE2ouD5jeYh3i36Iz+4p9XSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsupdate.exe

Path C:\ProgramData\windowsupdate.exe
Size 506KB
SHA256 39b1cd448c4ef2526f355b4d2865e5d76aa3e79cdd45895066156061ee3ecedf
MD5 1afb689a5aac9a249b9c43d18d3eb5f1
SHA1 5f0e5d8eadb26a3fc2d3e54583bd8414c66eabe8
SHA512 932c84da053571dbe41516db707a3681212ce34e8770984649b35bfa06473d420f30296930337b87508c3776546b50c119851c4629b88aa683096e1e9369655f
SSDEEP 6144:dUBKXaGChqkTzk2E2oIvD5seMisYhd28nPExa0AaAPIls3ueogX/f7M0PxSd9XrZ:oKYzhE2ouD5jeYh3i36Iz+4p9XSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

tmpE37D.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpE37D.tmp
Size 1KB
SHA256 dc6bc05e6b247bb378365bebe3a4a5996839263cb71c6380e4bbdc7b0689bbc0
MD5 18610bfc706f212de7d7266f081cecd7
SHA1 f24c4971d9c394511a3e208fea0ae73a5ba2fd4b
SHA512 8c0d7eed61226b41b23c9ff8459620bc74ccf9109a212d04a048bf01034df827f0483f90d698969f81b7bed3d00903004703dd92848a9b0f0ada3fab5a2238d7
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 7ff7795935b8385f36a9008cc14a2be10d9cfeb05b2c8e878b23e305dbced5b9
MD5 44cd7db22e77dee5605ee413aebdaf4e
SHA1 16c2102fc7e7136345c43703cd530051e7dc4ce8
SHA512 0d2c1a3fccf53bf06858db00fad7fc1c7015c9f9e4597d4309f14879d09b84d0c67c25f9d5382920b61f62a6289308f91eaeaac1f790c96b97c84c7ccc365f85
SSDEEP 96:Mn9WChM8wnqvsqvJCwoZQUn9WChM8wnqvsEHyqvJCworzQTiGeQHfg7lNXlUVk:M9/sUoJ9/sAHnorMe+g7lNj
MD5 SHA1 SHA512 SSDEEP

Submit Download

windowsupdate.exe

Path \ProgramData\windowsupdate.exe
Size 506KB
SHA256 39b1cd448c4ef2526f355b4d2865e5d76aa3e79cdd45895066156061ee3ecedf
MD5 1afb689a5aac9a249b9c43d18d3eb5f1
SHA1 5f0e5d8eadb26a3fc2d3e54583bd8414c66eabe8
SHA512 932c84da053571dbe41516db707a3681212ce34e8770984649b35bfa06473d420f30296930337b87508c3776546b50c119851c4629b88aa683096e1e9369655f
SSDEEP 6144:dUBKXaGChqkTzk2E2oIvD5seMisYhd28nPExa0AaAPIls3ueogX/f7M0PxSd9XrZ:oKYzhE2ouD5jeYh3i36Iz+4p9XSS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/584-76-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-78-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-62-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-63-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-65-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-67-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-69-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-71-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/584-72-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/1204-59-0x0000000075E51000-0x0000000075E53000-memory.dmp

Download

memory/1204-77-0x000000006C3E0000-0x000000006C98B000-memory.dmp

Download

memory/1204-79-0x0000000001D72000-0x0000000001D74000-memory.dmp

Download

memory/1232-85-0x0000000000C50000-0x0000000000CD2000-memory.dmp

Download

memory/1580-56-0x0000000005BE0000-0x0000000005C4E000-memory.dmp

Download

memory/1580-54-0x0000000000A60000-0x0000000000AE2000-memory.dmp

Download

memory/1580-61-0x0000000004CC0000-0x0000000004CEC000-memory.dmp

Download

memory/1580-55-0x0000000000810000-0x0000000000822000-memory.dmp

Download

memory/1928-88-0x000000006CE10000-0x000000006D3BB000-memory.dmp

Download