warzonerat | bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366

Resubmissions

19/08/2022, 15:57

220819-td6bnsfdfj10

12/07/2022, 08:24

220712-kapp3scff710

Analysis

max time kernel
207s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
12/07/2022, 08:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2254fd5aa66f24ce822bdf630ed2cbdc.exe
Size 146KB
Sample220712-kapp3scff7
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x00060000000231db-134.dat	warzonerat
behavioral2/files/0x00060000000231db-135.dat	warzonerat

Executes dropped EXE 1 IoCs

pid	Process
4344	scvhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\scvhost.exe"	2254fd5aa66f24ce822bdf630ed2cbdc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4252	powershell.exe
4252	powershell.exe
4920	powershell.exe
4920	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4252	powershell.exe
Token: SeDebugPrivilege	4920	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 4252	2740	2254fd5aa66f24ce822bdf630ed2cbdc.exe	81
PID 2740 wrote to memory of 4252	2740	2254fd5aa66f24ce822bdf630ed2cbdc.exe	81
PID 2740 wrote to memory of 4252	2740	2254fd5aa66f24ce822bdf630ed2cbdc.exe	81
PID 2740 wrote to memory of 4344	2740	2254fd5aa66f24ce822bdf630ed2cbdc.exe	83
PID 2740 wrote to memory of 4344	2740	2254fd5aa66f24ce822bdf630ed2cbdc.exe	83
PID 2740 wrote to memory of 4344	2740	2254fd5aa66f24ce822bdf630ed2cbdc.exe	83
PID 4344 wrote to memory of 4920	4344	scvhost.exe	85
PID 4344 wrote to memory of 4920	4344	scvhost.exe	85
PID 4344 wrote to memory of 4920	4344	scvhost.exe	85
PID 4344 wrote to memory of 2964	4344	scvhost.exe	86
PID 4344 wrote to memory of 2964	4344	scvhost.exe	86
PID 4344 wrote to memory of 2964	4344	scvhost.exe	86
PID 4344 wrote to memory of 2964	4344	scvhost.exe	86
PID 4344 wrote to memory of 2964	4344	scvhost.exe	86

C:\Users\Admin\AppData\Local\Temp\2254fd5aa66f24ce822bdf630ed2cbdc.exe
"C:\Users\Admin\AppData\Local\Temp\2254fd5aa66f24ce822bdf630ed2cbdc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4252
- C:\Users\Admin\Documents\scvhost.exe
  "C:\Users\Admin\Documents\scvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2964

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 e23d4333a89a6da112445d375e06123837e41dcf1e173253485109f39cec2d19
MD5 da97efcdd3c6ffd7c235a0cc7a6ddde1
SHA1 a4e1383feddc1bd5c727bae0a619c3df98c3100d
SHA512 1f3eb320694bde85317b21c9f5fda04b53e4d0c02cdccb0fd58773b12717fa8adf26c44e3dd7156602337dd05e8eb4a0455a2e220b0f6f5617407acd468864ba
SSDEEP 384:z6+BnlanTJWqJuIA6JXcHSWF/bEIofM/+SVFt+O26ih1k7yRn8xA:mylanTwqJuIDcHSUDEIL/aOS/+xA
MD5 SHA1 SHA512 SSDEEP

Submit Download

scvhost.exe

Path C:\Users\Admin\Documents\scvhost.exe
Size 146KB
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
SSDEEP 3072:zsAEZmjIxrUObrt/CRkQE2hB8qWjJ+oCz4bVVLTPmU9:z2YIhrrtqvoTCzgTLTPmU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

scvhost.exe

Path C:\Users\Admin\Documents\scvhost.exe
Size 146KB
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
SSDEEP 3072:zsAEZmjIxrUObrt/CRkQE2hB8qWjJ+oCz4bVVLTPmU9:z2YIhrrtqvoTCzgTLTPmU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2964-149-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/4252-137-0x0000000005F70000-0x0000000005FD6000-memory.dmp

Download

memory/4252-138-0x0000000005FE0000-0x0000000006046000-memory.dmp

Download

memory/4252-136-0x0000000005600000-0x0000000005622000-memory.dmp

Download

memory/4252-140-0x0000000006620000-0x000000000663E000-memory.dmp

Download

memory/4252-141-0x0000000006B60000-0x0000000006B92000-memory.dmp

Download

memory/4252-144-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Download

memory/4252-132-0x00000000056C0000-0x0000000005CE8000-memory.dmp

Download

memory/4252-146-0x0000000007F90000-0x000000000860A000-memory.dmp

Download

memory/4252-152-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Download

memory/4252-131-0x0000000004FD0000-0x0000000005006000-memory.dmp

Download

memory/4252-151-0x0000000007B70000-0x0000000007B7E000-memory.dmp

Download

memory/4920-142-0x0000000070A90000-0x0000000070ADC000-memory.dmp

Download

memory/4920-150-0x0000000007890000-0x0000000007926000-memory.dmp

Download

memory/4920-148-0x0000000007670000-0x000000000767A000-memory.dmp

Download

memory/4920-145-0x0000000007600000-0x000000000761A000-memory.dmp

Download

memory/4920-153-0x0000000007930000-0x0000000007938000-memory.dmp

Download

memory/4920-143-0x00000000068A0000-0x00000000068BE000-memory.dmp

Download