warzonerat | cd73963224e868c6240b66d110da419dfff6af9c411c6df4dbcb8d14b330719e

Analysis

max time kernel
91s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2022, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2f679de5443dac203b91769a4c1c909d.exe
Size 512KB
Sample220802-bmsstsedel
SHA256 cd73963224e868c6240b66d110da419dfff6af9c411c6df4dbcb8d14b330719e
MD5 2f679de5443dac203b91769a4c1c909d
SHA1 0c6abb07446d0bc0656b7304411de78f65d2e809
SHA512 03b8360952f710c378ab2a13587a04ef3520f9fe7ed23be0ec744a039ee1ee36db4e2e8f47336faa0fdd8e064aa4b9b34d410765f19d8f525fc19596804402e0
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

45.74.4.244:5199

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2604-145-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2604-147-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2604-148-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2604-152-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation	2f679de5443dac203b91769a4c1c909d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mpkly = "\"C:\\Users\\Admin\\AppData\\Roaming\\Eubdk\\Mpkly.exe\""	2f679de5443dac203b91769a4c1c909d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4116 set thread context of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4124	powershell.exe
4124	powershell.exe
4116	2f679de5443dac203b91769a4c1c909d.exe
4116	2f679de5443dac203b91769a4c1c909d.exe
4116	2f679de5443dac203b91769a4c1c909d.exe
4116	2f679de5443dac203b91769a4c1c909d.exe
4116	2f679de5443dac203b91769a4c1c909d.exe
4116	2f679de5443dac203b91769a4c1c909d.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4124	powershell.exe
Token: SeDebugPrivilege	4116	2f679de5443dac203b91769a4c1c909d.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2604	2f679de5443dac203b91769a4c1c909d.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 4124	4116	2f679de5443dac203b91769a4c1c909d.exe	85
PID 4116 wrote to memory of 4124	4116	2f679de5443dac203b91769a4c1c909d.exe	85
PID 4116 wrote to memory of 4124	4116	2f679de5443dac203b91769a4c1c909d.exe	85
PID 4116 wrote to memory of 3864	4116	2f679de5443dac203b91769a4c1c909d.exe	98
PID 4116 wrote to memory of 3864	4116	2f679de5443dac203b91769a4c1c909d.exe	98
PID 4116 wrote to memory of 3864	4116	2f679de5443dac203b91769a4c1c909d.exe	98
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 4116 wrote to memory of 2604	4116	2f679de5443dac203b91769a4c1c909d.exe	99
PID 2604 wrote to memory of 2784	2604	2f679de5443dac203b91769a4c1c909d.exe	100
PID 2604 wrote to memory of 2784	2604	2f679de5443dac203b91769a4c1c909d.exe	100
PID 2604 wrote to memory of 2784	2604	2f679de5443dac203b91769a4c1c909d.exe	100
PID 2604 wrote to memory of 2784	2604	2f679de5443dac203b91769a4c1c909d.exe	100
PID 2604 wrote to memory of 2784	2604	2f679de5443dac203b91769a4c1c909d.exe	100

C:\Users\Admin\AppData\Local\Temp\2f679de5443dac203b91769a4c1c909d.exe
"C:\Users\Admin\AppData\Local\Temp\2f679de5443dac203b91769a4c1c909d.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\2f679de5443dac203b91769a4c1c909d.exe
  C:\Users\Admin\AppData\Local\Temp\2f679de5443dac203b91769a4c1c909d.exe
  2⤵
  PID:3864
- C:\Users\Admin\AppData\Local\Temp\2f679de5443dac203b91769a4c1c909d.exe
  C:\Users\Admin\AppData\Local\Temp\2f679de5443dac203b91769a4c1c909d.exe
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2604-148-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2604-152-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2604-151-0x00000000041A0000-0x0000000004340000-memory.dmp

Download

memory/2604-147-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2604-145-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2784-150-0x0000000000B70000-0x0000000000B71000-memory.dmp

Download

memory/4116-131-0x0000000005550000-0x0000000005AF4000-memory.dmp

Download

memory/4116-132-0x0000000005040000-0x00000000050D2000-memory.dmp

Download

memory/4116-133-0x0000000004F80000-0x0000000004F8A000-memory.dmp

Download

memory/4116-130-0x0000000000690000-0x0000000000716000-memory.dmp

Download

memory/4124-135-0x0000000002A90000-0x0000000002AC6000-memory.dmp

Download

memory/4124-142-0x0000000006580000-0x000000000659A000-memory.dmp

Download

memory/4124-141-0x00000000076C0000-0x0000000007D3A000-memory.dmp

Download

memory/4124-140-0x0000000006080000-0x000000000609E000-memory.dmp

Download

memory/4124-139-0x0000000005A50000-0x0000000005AB6000-memory.dmp

Download

memory/4124-138-0x00000000058B0000-0x0000000005916000-memory.dmp

Download

memory/4124-137-0x0000000005810000-0x0000000005832000-memory.dmp

Download

memory/4124-136-0x0000000005170000-0x0000000005798000-memory.dmp

Download