warzonerat | c10a9477615e2070cd7bdfb136a14837607a48538a6301473809ed8cd83fd7c8

General

Target

Request For RFQ-Quote - Purchase order-#04973579329.exe
Size

332KB
MD5

2fa872c29baefef24bd046b7813a049d
SHA1

a1222c09bde48a4949a66df1b10d96eacbc83a37
SHA256

c10a9477615e2070cd7bdfb136a14837607a48538a6301473809ed8cd83fd7c8
SHA512

377a7b74d1e7dcb59cd571c6bd3ed24ee654215d719d20a96fb61a32c27e967f042b9a3b149100c87872dc0ae8923b3d4ebdb11418207ce8153daf1f9daf4ba1
SSDEEP

6144:NfimM71dJOEqCEINXeHCm2WRMCVdKrLPefCoJ8L77:gx32IReT2WRMCi/xh7

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

81.161.229.75:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/320-79-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/320-80-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/320-82-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/320-84-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/320-85-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/320-86-0x0000000000406DA4-mapping.dmp	warzonerat
behavioral1/memory/320-89-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/320-92-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyDGDSGSDGDGSstem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyDGDSGSDGDGSstem.exe	Powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Request For RFQ-Quote - Purchase order-#04973579329.exeaspnet_compiler.exe

description	pid	process	target process
PID 968 set thread context of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 948 set thread context of 320	948	aspnet_compiler.exe	cvtres.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

Request For RFQ-Quote - Purchase order-#04973579329.exePowershell.exe

pid process

968 Request For RFQ-Quote - Purchase order-#04973579329.exe
612 Powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request For RFQ-Quote - Purchase order-#04973579329.exePowershell.exe

description pid process

Token: SeDebugPrivilege 968 Request For RFQ-Quote - Purchase order-#04973579329.exe
Token: SeDebugPrivilege 612 Powershell.exe

pid	process
968	Request For RFQ-Quote - Purchase order-#04973579329.exe
612	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	968	Request For RFQ-Quote - Purchase order-#04973579329.exe
Token: SeDebugPrivilege	612	Powershell.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

Request For RFQ-Quote - Purchase order-#04973579329.exeaspnet_compiler.exe

description	pid	process	target process
PID 968 wrote to memory of 612	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 968 wrote to memory of 612	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 968 wrote to memory of 612	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 968 wrote to memory of 612	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 968 wrote to memory of 1484	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 1484	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 1484	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 1484	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 968 wrote to memory of 948	968	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe
PID 948 wrote to memory of 320	948	aspnet_compiler.exe	cvtres.exe

C:\Users\Admin\AppData\Local\Temp\Request For RFQ-Quote - Purchase order-#04973579329.exe
"C:\Users\Admin\AppData\Local\Temp\Request For RFQ-Quote - Purchase order-#04973579329.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Request For RFQ-Quote - Purchase order-#04973579329.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyDGDSGSDGDGSstem.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:612

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:1484

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
PID:320

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-82-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-84-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-75-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-77-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-79-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-89-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-92-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-86-0x0000000000406DA4-mapping.dmp

Download
memory/320-80-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-74-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/320-85-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/612-90-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/612-91-0x000000006FDD0000-0x000000007037B000-memory.dmp

Filesize
5.7MB

Download
memory/612-56-0x0000000000000000-mapping.dmp

Download
memory/948-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/948-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/948-72-0x0000000000230000-0x000000000023C000-memory.dmp

Filesize
48KB

Download
memory/948-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/948-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/948-67-0x000000000040F47E-mapping.dmp

Download
memory/948-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/948-73-0x0000000000240000-0x0000000000248000-memory.dmp

Filesize
32KB

Download
memory/948-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/948-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/948-60-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/968-54-0x0000000001320000-0x0000000001374000-memory.dmp

Filesize
336KB

Download
memory/968-57-0x0000000000310000-0x000000000032C000-memory.dmp

Filesize
112KB

Download
memory/968-55-0x0000000075501000-0x0000000075503000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads