warzonerat | 20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e

General

Target

SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
Size

888KB
MD5

1bcd34738e63d6e4c67d56a5ab8d3cd0
SHA1

8c8ee03272b9ec906ec060b39dd1b2ac0e820323
SHA256

20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e
SHA512

a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

51.195.145.82:5252

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1344-73-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-72-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-75-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-77-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-79-0x0000000000406DA4-mapping.dmp	warzonerat
behavioral1/memory/1344-78-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-82-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-85-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

description	pid	process	target process
PID 588 set thread context of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

1984 schtasks.exe

pid	process
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exepowershell.exepowershell.exe

pid	process
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
1156	powershell.exe
936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

Processes:

SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

description	pid	process	target process
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	powershell.exe
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	schtasks.exe
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	schtasks.exe
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	schtasks.exe
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	schtasks.exe
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp

Filesize
1KB

MD5
ce6bbbed227f81810a56f4abeb68c8da

SHA1
70dcc16c3fb54d8e36701621dfc69a7edeeb1f15

SHA256
1cc471481f27c50a91c6a35959d48d0e70ed854ce6f2635bc5d298908565ad02

SHA512
658bdc18c6ebb4cc3ae051022f59ba77fd07b1f867f038b5604fc13edb71583508291d4f2a740dfde356b742f5eece3a991c42a9d782568f76523232ef32e4d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
67486f580f900d97ca310d542e3d5dbe

SHA1
99470cd9e53f1b653a7d7f42685773fc6d66a259

SHA256
da297c8adec105e47c743916fd2d48f379f42380327bcf9db5717f6ff0e269e1

SHA512
4d5a0a1feacefcd17cc7195002787c09d0f951a9fc87d26ac3ac0fc55f3d444ca0119fc8ecf68de8c160986b0d4c44a8b95cf2e6fb1b03656a67abc41804d90d

Download Submit
memory/588-57-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/588-58-0x0000000005E40000-0x0000000005EBA000-memory.dmp

Filesize
488KB

Download
memory/588-56-0x0000000000240000-0x0000000000256000-memory.dmp

Filesize
88KB

Download
memory/588-55-0x0000000076231000-0x0000000076233000-memory.dmp

Filesize
8KB

Download
memory/588-66-0x0000000002350000-0x000000000237C000-memory.dmp

Filesize
176KB

Download
memory/588-54-0x0000000000B30000-0x0000000000C14000-memory.dmp

Filesize
912KB

Download
memory/936-61-0x0000000000000000-mapping.dmp

Download
memory/936-86-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/936-84-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/1156-83-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/1156-59-0x0000000000000000-mapping.dmp

Download
memory/1156-87-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/1344-68-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-72-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-75-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-77-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-79-0x0000000000406DA4-mapping.dmp

Download
memory/1344-78-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-82-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-73-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-70-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-85-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-67-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1984-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads