warzonerat | bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366

Resubmissions

19/08/2022, 15:57

220819-td6bnsfdfj10

12/07/2022, 08:24

220712-kapp3scff710

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
19/08/2022, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2254fd5aa66f24ce822bdf630ed2cbdc.exe
Size 146KB
Sample220819-td6bnsfdfj
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

benson12.ddns.net:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

IsPeFile 19 IoCs

resource	yara_rule
behavioral2/memory/2824-133-0x0000000002E90000-0x0000000002EC6000-memory.dmp	IsPeFile
behavioral2/memory/2824-134-0x00000000058F0000-0x0000000005F18000-memory.dmp	IsPeFile
behavioral2/memory/2824-135-0x00000000057B0000-0x00000000057D2000-memory.dmp	IsPeFile
behavioral2/memory/2824-136-0x0000000006090000-0x00000000060F6000-memory.dmp	IsPeFile
behavioral2/memory/2824-137-0x0000000006170000-0x00000000061D6000-memory.dmp	IsPeFile
behavioral2/memory/2824-138-0x0000000006770000-0x000000000678E000-memory.dmp	IsPeFile
behavioral2/files/0x0009000000022e06-140.dat	IsPeFile
behavioral2/files/0x0009000000022e06-141.dat	IsPeFile
behavioral2/memory/2824-142-0x0000000007910000-0x0000000007942000-memory.dmp	IsPeFile
behavioral2/memory/2824-143-0x0000000070730000-0x000000007077C000-memory.dmp	IsPeFile
behavioral2/memory/2824-144-0x0000000006D10000-0x0000000006D2E000-memory.dmp	IsPeFile
behavioral2/memory/2824-145-0x00000000080A0000-0x000000000871A000-memory.dmp	IsPeFile
behavioral2/memory/2824-146-0x0000000007A60000-0x0000000007A7A000-memory.dmp	IsPeFile
behavioral2/memory/2824-148-0x0000000007AD0000-0x0000000007ADA000-memory.dmp	IsPeFile
behavioral2/memory/2824-149-0x0000000007CE0000-0x0000000007D76000-memory.dmp	IsPeFile
behavioral2/memory/2824-150-0x0000000007C90000-0x0000000007C9E000-memory.dmp	IsPeFile
behavioral2/memory/2824-151-0x0000000007DA0000-0x0000000007DBA000-memory.dmp	IsPeFile
behavioral2/memory/2824-152-0x0000000007D80000-0x0000000007D88000-memory.dmp	IsPeFile
behavioral2/memory/4840-153-0x0000000070730000-0x000000007077C000-memory.dmp	IsPeFile

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/files/0x0009000000022e06-140.dat	warzonerat
behavioral2/files/0x0009000000022e06-141.dat	warzonerat

Executes dropped EXE 1 IoCs

pid	Process
4948	scvhost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\scvhost.exe"	2254fd5aa66f24ce822bdf630ed2cbdc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2824	powershell.exe
2824	powershell.exe
4840	powershell.exe
4840	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2824	powershell.exe
Token: SeDebugPrivilege	4840	powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2824	2060	2254fd5aa66f24ce822bdf630ed2cbdc.exe	81
PID 2060 wrote to memory of 2824	2060	2254fd5aa66f24ce822bdf630ed2cbdc.exe	81
PID 2060 wrote to memory of 2824	2060	2254fd5aa66f24ce822bdf630ed2cbdc.exe	81
PID 2060 wrote to memory of 4948	2060	2254fd5aa66f24ce822bdf630ed2cbdc.exe	83
PID 2060 wrote to memory of 4948	2060	2254fd5aa66f24ce822bdf630ed2cbdc.exe	83
PID 2060 wrote to memory of 4948	2060	2254fd5aa66f24ce822bdf630ed2cbdc.exe	83
PID 4948 wrote to memory of 4840	4948	scvhost.exe	84
PID 4948 wrote to memory of 4840	4948	scvhost.exe	84
PID 4948 wrote to memory of 4840	4948	scvhost.exe	84
PID 4948 wrote to memory of 4848	4948	scvhost.exe	86
PID 4948 wrote to memory of 4848	4948	scvhost.exe	86
PID 4948 wrote to memory of 4848	4948	scvhost.exe	86
PID 4948 wrote to memory of 4848	4948	scvhost.exe	86
PID 4948 wrote to memory of 4848	4948	scvhost.exe	86

C:\Users\Admin\AppData\Local\Temp\2254fd5aa66f24ce822bdf630ed2cbdc.exe
"C:\Users\Admin\AppData\Local\Temp\2254fd5aa66f24ce822bdf630ed2cbdc.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2824
- C:\Users\Admin\Documents\scvhost.exe
  "C:\Users\Admin\Documents\scvhost.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 18KB
SHA256 3623069cf96eca9ef689218ef7b79907d0b1de3b4d05ca6fbeca7a4514e50bf0
MD5 ec837d511cf4a524a8995f330b1e8909
SHA1 4c614fbefc7dbe7504bc279c351f0ee54eecb1e3
SHA512 31a46ce8e889dff7ab992ea644cace0a5c744edd9156049748b2afa15f4339d65d77361bc369c13e447276690198326404e4fe4f9d8c41fc4aa5523f2dceb407
SSDEEP 384:3sf+BG9i++DoCB+PcCtBv2Jk0eio9o2ThK6seYLME/N03SoZafYSgcjEDkyQ0gd4:cfmot5Jr0e3o2ThNgrWSVWCED/Ce3
MD5 SHA1 SHA512 SSDEEP

Submit Download

scvhost.exe

Path C:\Users\Admin\Documents\scvhost.exe
Size 146KB
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
SSDEEP 3072:zsAEZmjIxrUObrt/CRkQE2hB8qWjJ+oCz4bVVLTPmU9:z2YIhrrtqvoTCzgTLTPmU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

scvhost.exe

Path C:\Users\Admin\Documents\scvhost.exe
Size 146KB
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
SSDEEP 3072:zsAEZmjIxrUObrt/CRkQE2hB8qWjJ+oCz4bVVLTPmU9:z2YIhrrtqvoTCzgTLTPmU9
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2824-144-0x0000000006D10000-0x0000000006D2E000-memory.dmp

Download

memory/2824-152-0x0000000007D80000-0x0000000007D88000-memory.dmp

Download

memory/2824-138-0x0000000006770000-0x000000000678E000-memory.dmp

Download

memory/2824-133-0x0000000002E90000-0x0000000002EC6000-memory.dmp

Download

memory/2824-136-0x0000000006090000-0x00000000060F6000-memory.dmp

Download

memory/2824-135-0x00000000057B0000-0x00000000057D2000-memory.dmp

Download

memory/2824-142-0x0000000007910000-0x0000000007942000-memory.dmp

Download

memory/2824-143-0x0000000070730000-0x000000007077C000-memory.dmp

Download

memory/2824-145-0x00000000080A0000-0x000000000871A000-memory.dmp

Download

memory/2824-146-0x0000000007A60000-0x0000000007A7A000-memory.dmp

Download

memory/2824-134-0x00000000058F0000-0x0000000005F18000-memory.dmp

Download

memory/2824-148-0x0000000007AD0000-0x0000000007ADA000-memory.dmp

Download

memory/2824-149-0x0000000007CE0000-0x0000000007D76000-memory.dmp

Download

memory/2824-150-0x0000000007C90000-0x0000000007C9E000-memory.dmp

Download

memory/2824-151-0x0000000007DA0000-0x0000000007DBA000-memory.dmp

Download

memory/2824-137-0x0000000006170000-0x00000000061D6000-memory.dmp

Download

memory/4840-153-0x0000000070730000-0x000000007077C000-memory.dmp

Download

memory/4848-155-0x00000000011F0000-0x00000000011F1000-memory.dmp

Download