warzonerat | 1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361

General

Target

1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe
Size

1.4MB
MD5

c5cb27cb09bdc222aeffaf0cccb96bad
SHA1

d3d9681b8ee4730dca84d8cde608f12348bfe8e8
SHA256

1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361
SHA512

a05bc118eff3c215debbd9909dd3d34cb3d0f2adcb47ea29e626416275e7793096d6e8ba8448ebfff4fff93cb6b142d2fcae414a403de57ddce9029b019d6f8a

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

45.162.228.171:26112

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Aehhvhxfn = "\"C:\\Users\\Admin\\AppData\\Roaming\\Msfhxqaxh\\Aehhvhxfn.exe\""	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3328 set thread context of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Delays execution with timeout.exe 2 IoCs

evasion

pid	Process
1448	timeout.exe
4780	timeout.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe
3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 2240	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	78
PID 3328 wrote to memory of 2240	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	78
PID 3328 wrote to memory of 2240	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	78
PID 2240 wrote to memory of 4780	2240	cmd.exe	80
PID 2240 wrote to memory of 4780	2240	cmd.exe	80
PID 2240 wrote to memory of 4780	2240	cmd.exe	80
PID 3328 wrote to memory of 4764	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	81
PID 3328 wrote to memory of 4764	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	81
PID 3328 wrote to memory of 4764	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	81
PID 4764 wrote to memory of 1448	4764	cmd.exe	83
PID 4764 wrote to memory of 1448	4764	cmd.exe	83
PID 4764 wrote to memory of 1448	4764	cmd.exe	83
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85
PID 3328 wrote to memory of 4220	3328	1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe	85

C:\Users\Admin\AppData\Local\Temp\1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe
"C:\Users\Admin\AppData\Local\Temp\1851a8dd1eb684515d31bb1b3a2f162eab634af839c9ef1002a8fc40bed8e361.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout /nobreak /t 20
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2240
- - C:\Windows\SysWOW64\timeout.exe
    timeout /nobreak /t 20
    3⤵
    - Delays execution with timeout.exe
    PID:4780
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c timeout 45
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\timeout.exe
    timeout 45
    3⤵
    - Delays execution with timeout.exe
    PID:1448
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  2⤵
  PID:4220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3328-131-0x0000000005D70000-0x0000000006314000-memory.dmp

Filesize
5.6MB

Download
memory/3328-132-0x00000000058C0000-0x0000000005952000-memory.dmp

Filesize
584KB

Download
memory/3328-133-0x0000000005A60000-0x0000000005A6A000-memory.dmp

Filesize
40KB

Download
memory/3328-130-0x0000000000DB0000-0x0000000000F1C000-memory.dmp

Filesize
1.4MB

Download
memory/4220-139-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4220-141-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4220-143-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/4220-144-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing