New Order.exe
1MB
21-05-2022 18:41
behavioral2
fb5b35716632d1ec30f13ea6c1c8ac69
c4a066ecb0e73b431561eb5f209af51e361f0467
a33a4dcab1d0b4c87dc0041862aef871d365273a0baa94162ef4ff85af51c578
c1028ab4f4830c1166ba393ac1fff986e6c6cb9ada84af54c707998342005297e3abb16129368c2420cecebd4877d11edc9dca1ed118eabe349521e58139245b
Extracted
| Family | warzonerat |
| C2 |
79.134.225.40:5200 |
Filter: none
-
WarzoneRat, AveMaria
Description
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
Tags
-
Warzone RAT Payload
Tags
Reported IOCs
resource yara_rule behavioral2/memory/2052-130-0x0000000000BB0000-0x0000000000D03000-memory.dmp warzonerat behavioral2/memory/2052-132-0x0000000000AB0000-0x0000000000BB0000-memory.dmp warzonerat behavioral2/memory/4484-157-0x0000000001030000-0x0000000001183000-memory.dmp warzonerat -
Executes dropped EXEimages.exe
Reported IOCs
pid process 4484 images.exe -
Drops startup fileNew Order.exe
Reported IOCs
description ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start New Order.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat New Order.exe -
Adds Run key to start applicationNew Order.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" New Order.exe -
NTFS ADSNew Order.exe
Reported IOCs
description ioc process File created C:\ProgramData:ApplicationData New Order.exe -
Suspicious behavior: EnumeratesProcessespowershell.exepowershell.exe
Reported IOCs
pid process 828 powershell.exe 828 powershell.exe 3976 powershell.exe 3976 powershell.exe -
Suspicious use of AdjustPrivilegeTokenpowershell.exepowershell.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 828 powershell.exe Token: SeDebugPrivilege 3976 powershell.exe -
Suspicious use of WriteProcessMemoryNew Order.exeimages.exe
Reported IOCs
description pid process target process PID 2052 wrote to memory of 828 2052 New Order.exe powershell.exe PID 2052 wrote to memory of 828 2052 New Order.exe powershell.exe PID 2052 wrote to memory of 828 2052 New Order.exe powershell.exe PID 2052 wrote to memory of 4484 2052 New Order.exe images.exe PID 2052 wrote to memory of 4484 2052 New Order.exe images.exe PID 2052 wrote to memory of 4484 2052 New Order.exe images.exe PID 4484 wrote to memory of 3976 4484 images.exe powershell.exe PID 4484 wrote to memory of 3976 4484 images.exe powershell.exe PID 4484 wrote to memory of 3976 4484 images.exe powershell.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe PID 4484 wrote to memory of 4308 4484 images.exe cmd.exe
-
C:\Users\Admin\AppData\Local\Temp\New Order.exePID:2052"C:\Users\Admin\AppData\Local\Temp\New Order.exe"Drops startup fileAdds Run key to start applicationNTFS ADSSuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:828powershell Add-MpPreference -ExclusionPath C:\Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\ProgramData\images.exePID:4484"C:\ProgramData\images.exe"Executes dropped EXESuspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exePID:3976powershell Add-MpPreference -ExclusionPath C:\Suspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exePID:4308"C:\Windows\System32\cmd.exe"
-
C:\ProgramData\images.exe
MD5fb5b35716632d1ec30f13ea6c1c8ac69
SHA1c4a066ecb0e73b431561eb5f209af51e361f0467
SHA256a33a4dcab1d0b4c87dc0041862aef871d365273a0baa94162ef4ff85af51c578
SHA512c1028ab4f4830c1166ba393ac1fff986e6c6cb9ada84af54c707998342005297e3abb16129368c2420cecebd4877d11edc9dca1ed118eabe349521e58139245b
-
C:\ProgramData\images.exe
MD5fb5b35716632d1ec30f13ea6c1c8ac69
SHA1c4a066ecb0e73b431561eb5f209af51e361f0467
SHA256a33a4dcab1d0b4c87dc0041862aef871d365273a0baa94162ef4ff85af51c578
SHA512c1028ab4f4830c1166ba393ac1fff986e6c6cb9ada84af54c707998342005297e3abb16129368c2420cecebd4877d11edc9dca1ed118eabe349521e58139245b
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
MD5b0a5824f88e32f364473ce6987c15d59
SHA100b2951c5c593e61ce112f08acd15acb6c2f97e0
SHA256f448c6a7498d2559174f3cb71d0291e70380276fd7421fd7b4bf03f76736fe34
SHA512f8f58d2275dfbfe8cc06ba35a0e777906422f6afbe20cf10dbc62c5cbc0fcdd35ab6a81eba11d7e750a813d567f91c773e94dd48068f6b115e4e14af5f4d1157
-
memory/828-146-0x00000000061D0000-0x00000000061EE000-memory.dmp
-
memory/828-137-0x0000000000000000-mapping.dmp
-
memory/828-141-0x00000000028A0000-0x00000000028D6000-memory.dmp
-
memory/828-142-0x00000000053E0000-0x0000000005A08000-memory.dmp
-
memory/828-143-0x0000000005320000-0x0000000005342000-memory.dmp
-
memory/828-144-0x0000000005B00000-0x0000000005B66000-memory.dmp
-
memory/828-145-0x0000000005BE0000-0x0000000005C46000-memory.dmp
-
memory/828-155-0x0000000007810000-0x000000000782A000-memory.dmp
-
memory/828-147-0x00000000067A0000-0x00000000067D2000-memory.dmp
-
memory/828-148-0x00000000707A0000-0x00000000707EC000-memory.dmp
-
memory/828-149-0x0000000006780000-0x000000000679E000-memory.dmp
-
memory/828-150-0x0000000007B20000-0x000000000819A000-memory.dmp
-
memory/828-151-0x00000000074D0000-0x00000000074EA000-memory.dmp
-
memory/828-152-0x0000000007540000-0x000000000754A000-memory.dmp
-
memory/828-153-0x0000000007750000-0x00000000077E6000-memory.dmp
-
memory/828-154-0x0000000007700000-0x000000000770E000-memory.dmp
-
memory/828-156-0x00000000077F0000-0x00000000077F8000-memory.dmp
-
memory/2052-132-0x0000000000AB0000-0x0000000000BB0000-memory.dmp
-
memory/2052-130-0x0000000000BB0000-0x0000000000D03000-memory.dmp
-
memory/3976-163-0x0000000000000000-mapping.dmp
-
memory/3976-167-0x0000000070620000-0x000000007066C000-memory.dmp
-
memory/4308-166-0x0000000000000000-mapping.dmp
-
memory/4308-168-0x00000000009F0000-0x00000000009F1000-memory.dmp
-
memory/4484-157-0x0000000001030000-0x0000000001183000-memory.dmp
-
memory/4484-138-0x0000000000000000-mapping.dmp