warzonerat | e1f652cc24531e85e52b8a04cdaf9d925206c0d8d306426897868bd045729cc5

Analysis

max time kernel
90s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
20/06/2022, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Doc.exe
Size 368KB
Sample220620-c7khmaedd5
SHA256 e1f652cc24531e85e52b8a04cdaf9d925206c0d8d306426897868bd045729cc5
MD5 4f903936030582fea8ca1e01453fcff6
SHA1 4e3043978fbc1f7d5278929ec9f58ec2cd411eea
SHA512 04471921c50cff0879192fb25f35d71830351735dbd68cbec244b6947ba47fcb94acfc6ea2fae59050849a08cf13b40019dba38266ad92491398df5f1f806a23
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat suricata

Malware Config

Extracted

Family

warzonerat

gameofthrone.ddns.net:2345

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin
suricata
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
suricata: ET MALWARE Ave Maria/Warzone RAT Encrypted CnC Checkin (Inbound)
suricata

Warzone RAT Payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1160-137-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1160-139-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1160-140-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1160-142-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2936 set thread context of 1160	2936	Doc.exe	91

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2936	Doc.exe
2936	Doc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2936	Doc.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1160	Doc.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91
PID 2936 wrote to memory of 1160	2936	Doc.exe	91

C:\Users\Admin\AppData\Local\Temp\Doc.exe
"C:\Users\Admin\AppData\Local\Temp\Doc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2936
- C:\Users\Admin\AppData\Local\Temp\Doc.exe
  "C:\Users\Admin\AppData\Local\Temp\Doc.exe"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:1160

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1160-137-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1160-139-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1160-140-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1160-141-0x00000000047E0000-0x0000000004980000-memory.dmp

Download

memory/1160-142-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2936-130-0x0000000000B50000-0x0000000000BB2000-memory.dmp

Download

memory/2936-131-0x0000000005A10000-0x0000000005FB4000-memory.dmp

Download

memory/2936-132-0x0000000005540000-0x00000000055D2000-memory.dmp

Download

memory/2936-133-0x0000000005700000-0x000000000570A000-memory.dmp

Download

memory/2936-134-0x0000000005FC0000-0x0000000006166000-memory.dmp

Download

memory/2936-135-0x0000000009110000-0x00000000091AC000-memory.dmp

Download