warzonerat | c10a9477615e2070cd7bdfb136a14837607a48538a6301473809ed8cd83fd7c8

General

Target

Request For RFQ-Quote - Purchase order-#04973579329.exe
Size

332KB
MD5

2fa872c29baefef24bd046b7813a049d
SHA1

a1222c09bde48a4949a66df1b10d96eacbc83a37
SHA256

c10a9477615e2070cd7bdfb136a14837607a48538a6301473809ed8cd83fd7c8
SHA512

377a7b74d1e7dcb59cd571c6bd3ed24ee654215d719d20a96fb61a32c27e967f042b9a3b149100c87872dc0ae8923b3d4ebdb11418207ce8153daf1f9daf4ba1
SSDEEP

6144:NfimM71dJOEqCEINXeHCm2WRMCVdKrLPefCoJ8L77:gx32IReT2WRMCi/xh7

Score

10^/10

warzonerat evasion infostealer rat upx

Malware Config

Extracted

Family

warzonerat

C2

81.161.229.75:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 9 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1292-79-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1292-80-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1292-82-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1292-84-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1292-85-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1292-86-0x0000000000406DA4-mapping.dmp	warzonerat
behavioral1/memory/1292-89-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1292-92-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/1292-100-0x0000000004DE0000-0x0000000004E0D000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

Processes:

127.exe

pid process

1820 127.exe
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

1684 netsh.exe

pid	process
1820	127.exe

pid	process
1684	netsh.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\127.exe	upx
C:\Users\Admin\AppData\Local\Temp\127.exe	upx
behavioral1/memory/1820-99-0x0000000000060000-0x000000000008D000-memory.dmp	upx
behavioral1/memory/1820-101-0x0000000000060000-0x000000000008D000-memory.dmp	upx

Drops startup file 2 IoCs

Processes:

Powershell.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyDGDSGSDGDGSstem.exe	Powershell.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyDGDSGSDGDGSstem.exe	Powershell.exe

Loads dropped DLL 1 IoCs

Processes:

cvtres.exe

pid process

1292 cvtres.exe

pid	process
1292	cvtres.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

Request For RFQ-Quote - Purchase order-#04973579329.exeaspnet_compiler.exe

description	pid	process	target process
PID 980 set thread context of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 1068 set thread context of 1292	1068	aspnet_compiler.exe	cvtres.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

Powershell.exe

pid process

1724 Powershell.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Request For RFQ-Quote - Purchase order-#04973579329.exePowershell.exe

description pid process

Token: SeDebugPrivilege 980 Request For RFQ-Quote - Purchase order-#04973579329.exe
Token: SeDebugPrivilege 1724 Powershell.exe

pid	process
1724	Powershell.exe

description	pid	process
Token: SeDebugPrivilege	980	Request For RFQ-Quote - Purchase order-#04973579329.exe
Token: SeDebugPrivilege	1724	Powershell.exe

Suspicious use of WriteProcessMemory 34 IoCs

Processes:

Request For RFQ-Quote - Purchase order-#04973579329.exeaspnet_compiler.execvtres.exe127.exe

description	pid	process	target process
PID 980 wrote to memory of 1724	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 980 wrote to memory of 1724	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 980 wrote to memory of 1724	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 980 wrote to memory of 1724	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	Powershell.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 980 wrote to memory of 1068	980	Request For RFQ-Quote - Purchase order-#04973579329.exe	aspnet_compiler.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1068 wrote to memory of 1292	1068	aspnet_compiler.exe	cvtres.exe
PID 1292 wrote to memory of 1820	1292	cvtres.exe	127.exe
PID 1292 wrote to memory of 1820	1292	cvtres.exe	127.exe
PID 1292 wrote to memory of 1820	1292	cvtres.exe	127.exe
PID 1292 wrote to memory of 1820	1292	cvtres.exe	127.exe
PID 1820 wrote to memory of 1684	1820	127.exe	netsh.exe
PID 1820 wrote to memory of 1684	1820	127.exe	netsh.exe
PID 1820 wrote to memory of 1684	1820	127.exe	netsh.exe
PID 1820 wrote to memory of 1684	1820	127.exe	netsh.exe

C:\Users\Admin\AppData\Local\Temp\Request For RFQ-Quote - Purchase order-#04973579329.exe
"C:\Users\Admin\AppData\Local\Temp\Request For RFQ-Quote - Purchase order-#04973579329.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:980

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
"Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\Request For RFQ-Quote - Purchase order-#04973579329.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SyDGDSGSDGDGSstem.exe'
2⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1724

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1068

C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1292

C:\Users\Admin\AppData\Local\Temp\127.exe
"C:\Users\Admin\AppData\Local\Temp\127.exe"
4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\netsh.exe
netsh advfirewall firewall add rule name="3389" dir=in action=allow protocol=TCP localport=3389
5⤵
- Modifies Windows Firewall
PID:1684

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

1

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\127.exe

Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
\Users\Admin\AppData\Local\Temp\127.exe

Filesize
70KB

MD5
ca96229390a0e6a53e8f2125f2c01114

SHA1
a54b1081cf58724f8cb292b4d165dfee2fb1c9f6

SHA256
0df3d05900e7b530f6c2a281d43c47839f2cf2a5d386553c8dc46e463a635a2c

SHA512
e93445bce6c8b6f51890309577a0ea9369860d2e6bf8cc0ca708879a77bb176d27c5f559bbdb7deb4b719aee0fc48d9068c293559f7629baf4ec3515898102ef

Download Submit
memory/980-54-0x0000000001040000-0x0000000001094000-memory.dmp

Filesize
336KB

Download
memory/980-55-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/980-58-0x0000000000260000-0x000000000027C000-memory.dmp

Filesize
112KB

Download
memory/1068-65-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1068-62-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1068-64-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1068-60-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1068-66-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1068-67-0x000000000040F47E-mapping.dmp

Download
memory/1068-69-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1068-71-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1068-72-0x0000000000210000-0x000000000021C000-memory.dmp

Filesize
48KB

Download
memory/1068-73-0x0000000000260000-0x0000000000268000-memory.dmp

Filesize
32KB

Download
memory/1068-59-0x0000000000400000-0x0000000000430000-memory.dmp

Filesize
192KB

Download
memory/1292-79-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-86-0x0000000000406DA4-mapping.dmp

Download
memory/1292-75-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-80-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-82-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-84-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-85-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-98-0x0000000004DE0000-0x0000000004E0D000-memory.dmp

Filesize
180KB

Download
memory/1292-89-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-77-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-100-0x0000000004DE0000-0x0000000004E0D000-memory.dmp

Filesize
180KB

Download
memory/1292-92-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1292-74-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/1684-96-0x0000000000000000-mapping.dmp

Download
memory/1724-90-0x000000006FC40000-0x00000000701EB000-memory.dmp

Filesize
5.7MB

Download
memory/1724-56-0x0000000000000000-mapping.dmp

Download
memory/1724-91-0x000000006FC40000-0x00000000701EB000-memory.dmp

Filesize
5.7MB

Download
memory/1820-94-0x0000000000000000-mapping.dmp

Download
memory/1820-99-0x0000000000060000-0x000000000008D000-memory.dmp

Filesize
180KB

Download
memory/1820-101-0x0000000000060000-0x000000000008D000-memory.dmp

Filesize
180KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads