warzonerat | 20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e

General

Target

SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
Size

888KB
MD5

1bcd34738e63d6e4c67d56a5ab8d3cd0
SHA1

8c8ee03272b9ec906ec060b39dd1b2ac0e820323
SHA256

20f1a52cdcc9248da403d92ef63b76463276fbe27ef0cb8f7a5d862c325b1b5e
SHA512

a095f1e9de182c0b6c01d6e7de354074b7df236dfe7ec568456b82252a675a3fe7e8a948e8c2b155b70a29f1a86b4e598ba8b2df83ed300345f0918c9b3b90c1

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

51.195.145.82:5252

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1572-145-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/1572-147-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/1572-149-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/1572-161-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4292 set thread context of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
5104	powershell.exe
4584	powershell.exe
4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
4584	powershell.exe
5104	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
Token: SeDebugPrivilege	5104	powershell.exe
Token: SeDebugPrivilege	4584	powershell.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 5104	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	82
PID 4292 wrote to memory of 5104	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	82
PID 4292 wrote to memory of 5104	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	82
PID 4292 wrote to memory of 4584	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	84
PID 4292 wrote to memory of 4584	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	84
PID 4292 wrote to memory of 4584	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	84
PID 4292 wrote to memory of 4204	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	86
PID 4292 wrote to memory of 4204	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	86
PID 4292 wrote to memory of 4204	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	86
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88
PID 4292 wrote to memory of 1572	4292	SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe	88

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5104
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\vlIWgaRWGWjiqw.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\vlIWgaRWGWjiqw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA930.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4204
- C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe
  "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILZilla.22184.14819.exe"
  2⤵
  PID:1572

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
32372bfda0f860418db86450740c7e98

SHA1
ffea70f985c50f62b13071fab6cfb9c0fc9ab1d9

SHA256
7ab340d93f3456b1fee684181de8c0ee7d85406ec67fa630e93b1c55401dc820

SHA512
464a184c9a01fab9aaf014953af299b8cc4c56e96f2d398a7d9a0bab35ca39503dcd35227d125b13080ede5f8645be0126a663bea8635b62b7a6b91294eaae80

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpA930.tmp

Filesize
1KB

MD5
5bbd1af9ade80dad3120943ad9792dfc

SHA1
47caad8f37f26e15df2d7627313e8cb4037bdff5

SHA256
683b515da446ac70fafaed94b50706d5b808c8caada02eb0680efb97c852d123

SHA512
60ace9137c7629ff2302a8683daba35a4314b80822808de52e4d73fb2debd50b9c9e7727773270d92291382239eb615fcbf3e175f9c4375d860302a1dac97f6e

Download Submit
memory/1572-161-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1572-145-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1572-147-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1572-149-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/4292-130-0x0000000000490000-0x0000000000574000-memory.dmp

Filesize
912KB

Download
memory/4292-135-0x000000000B590000-0x000000000B5F6000-memory.dmp

Filesize
408KB

Download
memory/4292-134-0x0000000008A50000-0x0000000008AEC000-memory.dmp

Filesize
624KB

Download
memory/4292-133-0x00000000050C0000-0x00000000050CA000-memory.dmp

Filesize
40KB

Download
memory/4292-132-0x0000000004F00000-0x0000000004F92000-memory.dmp

Filesize
584KB

Download
memory/4292-131-0x0000000005560000-0x0000000005B04000-memory.dmp

Filesize
5.6MB

Download
memory/4584-155-0x0000000007430000-0x0000000007AAA000-memory.dmp

Filesize
6.5MB

Download
memory/4584-157-0x0000000007070000-0x0000000007106000-memory.dmp

Filesize
600KB

Download
memory/4584-141-0x0000000004A20000-0x0000000004A42000-memory.dmp

Filesize
136KB

Download
memory/4584-160-0x0000000007110000-0x0000000007118000-memory.dmp

Filesize
32KB

Download
memory/4584-159-0x0000000007130000-0x000000000714A000-memory.dmp

Filesize
104KB

Download
memory/4584-152-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Filesize
304KB

Download
memory/5104-154-0x0000000007780000-0x000000000779A000-memory.dmp

Filesize
104KB

Download
memory/5104-153-0x0000000006A40000-0x0000000006A5E000-memory.dmp

Filesize
120KB

Download
memory/5104-143-0x0000000005660000-0x00000000056C6000-memory.dmp

Filesize
408KB

Download
memory/5104-138-0x0000000004ED0000-0x0000000004F06000-memory.dmp

Filesize
216KB

Download
memory/5104-156-0x00000000077F0000-0x00000000077FA000-memory.dmp

Filesize
40KB

Download
memory/5104-151-0x0000000070BE0000-0x0000000070C2C000-memory.dmp

Filesize
304KB

Download
memory/5104-158-0x00000000079C0000-0x00000000079CE000-memory.dmp

Filesize
56KB

Download
memory/5104-150-0x0000000006A60000-0x0000000006A92000-memory.dmp

Filesize
200KB

Download
memory/5104-140-0x00000000056E0000-0x0000000005D08000-memory.dmp

Filesize
6.2MB

Download
memory/5104-148-0x0000000006480000-0x000000000649E000-memory.dmp

Filesize
120KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads