warzonerat | 63ffad17f29cec99a45b9fe2c2ac410ef658da920f681beabaa0e4a347cc22df

Analysis

max time kernel
187s
max time network
196s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WINLOGONW.EXE.exe
Size 435KB
Sample221013-pt2wzaeaar
SHA256 63ffad17f29cec99a45b9fe2c2ac410ef658da920f681beabaa0e4a347cc22df
MD5 f2f861cc0985546a748142eaca913cfb
SHA1 f26db0c99c531261780a9f2fc3584d50328ad9af
SHA512 875761c5369c293c351b0cdd3fedaf6b5048ab481b1dd29bd2c61df577063fd6f8b996398aef31e77ec11a49aa0e9578f6933c2f105e60e9af3de0233119371a
SSDEEP 12288:NzJgOANDP7OXCVnwGVnljwxwxDnGVZu0+O:NzJSDP7OXAwGVlMxwxDGLu0n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

45.74.4.244:5199

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3592-147-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3592-149-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3592-150-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3592-153-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation	WINLOGONW.EXE.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5092 set thread context of 3592	5092	WINLOGONW.EXE.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4416	powershell.exe
4416	powershell.exe
5092	WINLOGONW.EXE.exe
5092	WINLOGONW.EXE.exe
5092	WINLOGONW.EXE.exe
5092	WINLOGONW.EXE.exe
5092	WINLOGONW.EXE.exe
5092	WINLOGONW.EXE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4416	powershell.exe
Token: SeDebugPrivilege	5092	WINLOGONW.EXE.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4416	5092	WINLOGONW.EXE.exe	83
PID 5092 wrote to memory of 4416	5092	WINLOGONW.EXE.exe	83
PID 5092 wrote to memory of 4416	5092	WINLOGONW.EXE.exe	83
PID 5092 wrote to memory of 3868	5092	WINLOGONW.EXE.exe	85
PID 5092 wrote to memory of 3868	5092	WINLOGONW.EXE.exe	85
PID 5092 wrote to memory of 3868	5092	WINLOGONW.EXE.exe	85
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 5092 wrote to memory of 3592	5092	WINLOGONW.EXE.exe	86
PID 3592 wrote to memory of 1928	3592	WINLOGONW.EXE.exe	89
PID 3592 wrote to memory of 1928	3592	WINLOGONW.EXE.exe	89
PID 3592 wrote to memory of 1928	3592	WINLOGONW.EXE.exe	89
PID 3592 wrote to memory of 1928	3592	WINLOGONW.EXE.exe	89
PID 3592 wrote to memory of 1928	3592	WINLOGONW.EXE.exe	89

C:\Users\Admin\AppData\Local\Temp\WINLOGONW.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\WINLOGONW.EXE.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4416
- C:\Users\Admin\AppData\Local\Temp\WINLOGONW.EXE.exe
  C:\Users\Admin\AppData\Local\Temp\WINLOGONW.EXE.exe
  2⤵
  PID:3868
- C:\Users\Admin\AppData\Local\Temp\WINLOGONW.EXE.exe
  C:\Users\Admin\AppData\Local\Temp\WINLOGONW.EXE.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3592
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1928

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1928-152-0x0000000001370000-0x0000000001371000-memory.dmp

Download

memory/3592-153-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3592-150-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3592-149-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/3592-147-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4416-137-0x0000000004D70000-0x0000000004DA6000-memory.dmp

Download

memory/4416-141-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/4416-142-0x00000000063C0000-0x00000000063DE000-memory.dmp

Download

memory/4416-143-0x0000000007C50000-0x00000000082CA000-memory.dmp

Download

memory/4416-144-0x00000000068E0000-0x00000000068FA000-memory.dmp

Download

memory/4416-140-0x00000000054A0000-0x0000000005506000-memory.dmp

Download

memory/4416-139-0x00000000050F0000-0x0000000005112000-memory.dmp

Download

memory/4416-138-0x0000000005540000-0x0000000005B68000-memory.dmp

Download

memory/5092-132-0x0000000000EC0000-0x0000000000F32000-memory.dmp

Download

memory/5092-135-0x00000000058E0000-0x00000000058EA000-memory.dmp

Download

memory/5092-134-0x0000000005920000-0x00000000059B2000-memory.dmp

Download

memory/5092-133-0x0000000005E30000-0x00000000063D4000-memory.dmp

Download