warzonerat | d0ea29feebc8734fd4c8d700956908b64546161298bce475099cb4d2b6d76877

General

Target
RTM0074163 doc.com.exe
Size 869KB
Sample220930-g4xe8scfh9
SHA256 d0ea29feebc8734fd4c8d700956908b64546161298bce475099cb4d2b6d76877
MD5 0012951e81cb2957fd658ce7580d3203
SHA1 43f7be229d08ce2681673154395a85d45386f67a
SHA512 623bc843d9e296a11b680dd28121996234c9490ca88c5ae25a5da39dbcdbc25307463cc1c23e2da2ba8a443c079089cfdbdde6f75458e7b536bd2223096b70ed
SSDEEP 12288:fNc++q2iNbAmDsuxgb/ZCBCdkcERLQ2iu5QkWIAOBK2qjJ5nnlKwHJADgD5MZS+H:fNc+P1RDugNxRTNKBjrl8
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat evasion infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

194.5.98.39:4020

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions	RTM0074163 doc.com.exe

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2216-139-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/2216-141-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/2216-142-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/2216-146-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Looks for VMWare Tools registry key 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools	RTM0074163 doc.com.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	RTM0074163 doc.com.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	RTM0074163 doc.com.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	RTM0074163 doc.com.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	RTM0074163 doc.com.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2764 set thread context of 2216	2764	RTM0074163 doc.com.exe	89

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2216	RTM0074163 doc.com.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2764 wrote to memory of 2216	2764	RTM0074163 doc.com.exe	89
PID 2216 wrote to memory of 2728	2216	RTM0074163 doc.com.exe	91
PID 2216 wrote to memory of 2728	2216	RTM0074163 doc.com.exe	91
PID 2216 wrote to memory of 2728	2216	RTM0074163 doc.com.exe	91
PID 2216 wrote to memory of 2728	2216	RTM0074163 doc.com.exe	91
PID 2216 wrote to memory of 2728	2216	RTM0074163 doc.com.exe	91

C:\Users\Admin\AppData\Local\Temp\RTM0074163 doc.com.exe
"C:\Users\Admin\AppData\Local\Temp\RTM0074163 doc.com.exe"
1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Users\Admin\AppData\Local\Temp\RTM0074163 doc.com.exe
  "{path}"
  2⤵
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2216
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2728

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Virtualization/Sandbox Evasion

2

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2216-142-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2216-141-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2216-146-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2216-139-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2216-145-0x000000000B5A0000-0x000000000B740000-memory.dmp

Download

memory/2728-144-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/2764-137-0x000000000D420000-0x000000000D486000-memory.dmp

Download

memory/2764-133-0x00000000056A0000-0x0000000005C44000-memory.dmp

Download

memory/2764-132-0x0000000000670000-0x000000000074E000-memory.dmp

Download

memory/2764-136-0x00000000051C0000-0x00000000051CA000-memory.dmp

Download

memory/2764-135-0x0000000005230000-0x00000000052CC000-memory.dmp

Download

memory/2764-134-0x00000000050F0000-0x0000000005182000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads