warzonerat | 20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e

Analysis

max time kernel
138s
max time network
153s
platform
windows7_x64
resource
win7-20220715-en
submitted
26-07-2022 07:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
Size

888KB
MD5

1bcd34738e63d6e4c67d56a5ab8d3cd0
SHA1

8c8ee03272b9ec906ec060b39dd1b2ac0e820323
SHA256

20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e
SHA512

a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

51.195.145.82:5252

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

resource	yara_rule
behavioral1/memory/1344-73-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-72-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-75-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-77-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-79-0x0000000000406DA4-mapping.dmp	warzonerat
behavioral1/memory/1344-78-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-82-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1344-85-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 588 set thread context of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
1156	powershell.exe
936	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
Token: SeDebugPrivilege	1156	powershell.exe
Token: SeDebugPrivilege	936	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	27
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	27
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	27
PID 588 wrote to memory of 1156	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	27
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	29
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	29
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	29
PID 588 wrote to memory of 936	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	29
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	31
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	31
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	31
PID 588 wrote to memory of 1984	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	31
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	33
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	33
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	33
PID 588 wrote to memory of 1644	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	33
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34
PID 588 wrote to memory of 1344	588	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	34

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:588
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1156
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:936
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:1984
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  PID:1644
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  PID:1344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE570.tmp

Filesize
1KB

MD5
ce6bbbed227f81810a56f4abeb68c8da

SHA1
70dcc16c3fb54d8e36701621dfc69a7edeeb1f15

SHA256
1cc471481f27c50a91c6a35959d48d0e70ed854ce6f2635bc5d298908565ad02

SHA512
658bdc18c6ebb4cc3ae051022f59ba77fd07b1f867f038b5604fc13edb71583508291d4f2a740dfde356b742f5eece3a991c42a9d782568f76523232ef32e4d3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
67486f580f900d97ca310d542e3d5dbe

SHA1
99470cd9e53f1b653a7d7f42685773fc6d66a259

SHA256
da297c8adec105e47c743916fd2d48f379f42380327bcf9db5717f6ff0e269e1

SHA512
4d5a0a1feacefcd17cc7195002787c09d0f951a9fc87d26ac3ac0fc55f3d444ca0119fc8ecf68de8c160986b0d4c44a8b95cf2e6fb1b03656a67abc41804d90d

Download Submit
memory/588-57-0x0000000000250000-0x000000000025A000-memory.dmp

Filesize
40KB

Download
memory/588-58-0x0000000005E40000-0x0000000005EBA000-memory.dmp

Filesize
488KB

Download
memory/588-56-0x0000000000240000-0x0000000000256000-memory.dmp

Filesize
88KB

Download
memory/588-55-0x0000000076231000-0x0000000076233000-memory.dmp

Filesize
8KB

Download
memory/588-66-0x0000000002350000-0x000000000237C000-memory.dmp

Filesize
176KB

Download
memory/588-54-0x0000000000B30000-0x0000000000C14000-memory.dmp

Filesize
912KB

Download
memory/936-86-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/936-84-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/1156-83-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/1156-87-0x000000006F600000-0x000000006FBAB000-memory.dmp

Filesize
5.7MB

Download
memory/1344-68-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-72-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-75-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-77-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-78-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-82-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-73-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-70-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-85-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1344-67-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download