warzonerat | ec197f82688c7181d0c185f7dfd2a60cd74187380247ebaacec7cbc9c7c3585b

Analysis

max time kernel
91s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2022, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
WINPLAYEER.EXE.exe
Size 445KB
Sample221013-pt2wzaebe7
SHA256 ec197f82688c7181d0c185f7dfd2a60cd74187380247ebaacec7cbc9c7c3585b
MD5 91bb5739afce122ddea99a91758bde4a
SHA1 f61823897e81e3cc806de9a3dd9d949418bcad44
SHA512 bf2c8b038949f3c030ef184f2eb6cf783c2f547d326464114c47ec3fec3cde8b864b290002eb034b08a80b990c69df1a51d71dd2c5eaf40bece8da895ce4f06b
SSDEEP 12288:IgrWS4fIDlKLCbseNDdjwVsuDnGVZu0+O:V3MLaseNpMV9DGLu0n
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

dgorijan20785.hopto.org:5199

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/4640-147-0x0000000000400000-0x0000000000559000-memory.dmp	warzonerat
behavioral2/memory/4640-149-0x0000000000400000-0x0000000000559000-memory.dmp	warzonerat
behavioral2/memory/4640-150-0x0000000000400000-0x0000000000559000-memory.dmp	warzonerat
behavioral2/memory/4640-154-0x0000000000400000-0x0000000000559000-memory.dmp	warzonerat
behavioral2/memory/1588-163-0x0000000000400000-0x0000000000559000-memory.dmp	warzonerat
behavioral2/memory/1588-164-0x0000000000400000-0x0000000000559000-memory.dmp	warzonerat
behavioral2/memory/1588-168-0x0000000000400000-0x0000000000559000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
2304	wintsklt.exe
1588	wintsklt.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	WINPLAYEER.EXE.exe
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	wintsklt.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	WINPLAYEER.EXE.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	WINPLAYEER.EXE.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wintask = "C:\\Users\\Admin\\Documents\\wintsklt.exe"	WINPLAYEER.EXE.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2304 set thread context of 1588	2304	wintsklt.exe	99

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Documents\Documents:ApplicationData	WINPLAYEER.EXE.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3136	powershell.exe
3136	powershell.exe
2168	WINPLAYEER.EXE.exe
2168	WINPLAYEER.EXE.exe
2168	WINPLAYEER.EXE.exe
2168	WINPLAYEER.EXE.exe
2168	WINPLAYEER.EXE.exe
2168	WINPLAYEER.EXE.exe
2148	powershell.exe
2148	powershell.exe
2304	wintsklt.exe
2304	wintsklt.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	powershell.exe
Token: SeDebugPrivilege	2168	WINPLAYEER.EXE.exe
Token: SeDebugPrivilege	2148	powershell.exe
Token: SeDebugPrivilege	2304	wintsklt.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1588	wintsklt.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 2168 wrote to memory of 3136	2168	WINPLAYEER.EXE.exe	85
PID 2168 wrote to memory of 3136	2168	WINPLAYEER.EXE.exe	85
PID 2168 wrote to memory of 3136	2168	WINPLAYEER.EXE.exe	85
PID 2168 wrote to memory of 2736	2168	WINPLAYEER.EXE.exe	94
PID 2168 wrote to memory of 2736	2168	WINPLAYEER.EXE.exe	94
PID 2168 wrote to memory of 2736	2168	WINPLAYEER.EXE.exe	94
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 2168 wrote to memory of 4640	2168	WINPLAYEER.EXE.exe	95
PID 4640 wrote to memory of 2304	4640	WINPLAYEER.EXE.exe	96
PID 4640 wrote to memory of 2304	4640	WINPLAYEER.EXE.exe	96
PID 4640 wrote to memory of 2304	4640	WINPLAYEER.EXE.exe	96
PID 2304 wrote to memory of 2148	2304	wintsklt.exe	97
PID 2304 wrote to memory of 2148	2304	wintsklt.exe	97
PID 2304 wrote to memory of 2148	2304	wintsklt.exe	97
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 2304 wrote to memory of 1588	2304	wintsklt.exe	99
PID 1588 wrote to memory of 792	1588	wintsklt.exe	100
PID 1588 wrote to memory of 792	1588	wintsklt.exe	100
PID 1588 wrote to memory of 792	1588	wintsklt.exe	100
PID 1588 wrote to memory of 792	1588	wintsklt.exe	100
PID 1588 wrote to memory of 792	1588	wintsklt.exe	100

C:\Users\Admin\AppData\Local\Temp\WINPLAYEER.EXE.exe
"C:\Users\Admin\AppData\Local\Temp\WINPLAYEER.EXE.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2168
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3136
- C:\Users\Admin\AppData\Local\Temp\WINPLAYEER.EXE.exe
  C:\Users\Admin\AppData\Local\Temp\WINPLAYEER.EXE.exe
  2⤵
  PID:2736
- C:\Users\Admin\AppData\Local\Temp\WINPLAYEER.EXE.exe
  C:\Users\Admin\AppData\Local\Temp\WINPLAYEER.EXE.exe
  2⤵
  - Drops startup file
  - Adds Run key to start application
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Users\Admin\Documents\wintsklt.exe
    "C:\Users\Admin\Documents\wintsklt.exe"
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2148
  - - C:\Users\Admin\Documents\wintsklt.exe
      C:\Users\Admin\Documents\wintsklt.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1588
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:792

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3254495a5513b37a2686a876d0040275414699e7ce760e7b5ee05e41a54b96f5
MD5 6195a91754effb4df74dbc72cdf4f7a6
SHA1 aba262f5726c6d77659fe0d3195e36a85046b427
SHA512 ed723d15de267390dc93263538428e2c881be3494c996a810616b470d6df7d5acfcc8725687d5c50319ebef45caef44f769bfc32e0dc3abd249dacff4a12cc89
MD5 SHA1 SHA512

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
MD5 06ad34f9739c5159b4d92d702545bd49
SHA1 9152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA512 c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
SSDEEP 1536:q5C+jH04tAHkCSMrxyNhftflJdPYoFi3j39MVvjMLUsszyhMUp7Fv+Eca5b/h4ie:KC+jH04tAHk5MrxyNhftflJdPYoFi3jc
MD5 SHA1 SHA512 SSDEEP

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 16KB
SHA256 c74411322ac40dec0ccaa5ed9c2e6b53d26c6900d749c5754143b30c69a8825e
MD5 3ef55121b11c2058db84e6066e8db2e4
SHA1 a79386ab75a263ed944cef953ffc04426d139aab
SHA512 f62dc60c28de0bbda9fc34741bccddb1d7578275c4068a66e59e8371681f0a681b2a4bd950c0cf0870d72dfcc2333dcfd27e9ea0fdf54e30c9040158801301b5
SSDEEP 384:tj+j/9i+mhXahPwEX4jXBJzpkIo9o2TVK6seYZI5/r03SoZIfYSPUjE0LiQ:BLXgFIjXzm9o2TVNyuYSvRqE0P
MD5 SHA1 SHA512 SSDEEP

Submit Download

wintsklt.exe

Path C:\Users\Admin\Documents\wintsklt.exe
Size 445KB
SHA256 ec197f82688c7181d0c185f7dfd2a60cd74187380247ebaacec7cbc9c7c3585b
MD5 91bb5739afce122ddea99a91758bde4a
SHA1 f61823897e81e3cc806de9a3dd9d949418bcad44
SHA512 bf2c8b038949f3c030ef184f2eb6cf783c2f547d326464114c47ec3fec3cde8b864b290002eb034b08a80b990c69df1a51d71dd2c5eaf40bece8da895ce4f06b
SSDEEP 12288:IgrWS4fIDlKLCbseNDdjwVsuDnGVZu0+O:V3MLaseNpMV9DGLu0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

wintsklt.exe

Path C:\Users\Admin\Documents\wintsklt.exe
Size 445KB
SHA256 ec197f82688c7181d0c185f7dfd2a60cd74187380247ebaacec7cbc9c7c3585b
MD5 91bb5739afce122ddea99a91758bde4a
SHA1 f61823897e81e3cc806de9a3dd9d949418bcad44
SHA512 bf2c8b038949f3c030ef184f2eb6cf783c2f547d326464114c47ec3fec3cde8b864b290002eb034b08a80b990c69df1a51d71dd2c5eaf40bece8da895ce4f06b
SSDEEP 12288:IgrWS4fIDlKLCbseNDdjwVsuDnGVZu0+O:V3MLaseNpMV9DGLu0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

wintsklt.exe

Path C:\Users\Admin\Documents\wintsklt.exe
Size 445KB
SHA256 ec197f82688c7181d0c185f7dfd2a60cd74187380247ebaacec7cbc9c7c3585b
MD5 91bb5739afce122ddea99a91758bde4a
SHA1 f61823897e81e3cc806de9a3dd9d949418bcad44
SHA512 bf2c8b038949f3c030ef184f2eb6cf783c2f547d326464114c47ec3fec3cde8b864b290002eb034b08a80b990c69df1a51d71dd2c5eaf40bece8da895ce4f06b
SSDEEP 12288:IgrWS4fIDlKLCbseNDdjwVsuDnGVZu0+O:V3MLaseNpMV9DGLu0n
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/792-166-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/1588-167-0x000000000AC50000-0x000000000ADF0000-memory.dmp

Download

memory/1588-164-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/1588-163-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/1588-168-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/2168-132-0x0000000000FC0000-0x0000000001036000-memory.dmp

Download

memory/2168-135-0x0000000005A30000-0x0000000005A3A000-memory.dmp

Download

memory/2168-134-0x0000000005970000-0x0000000005A02000-memory.dmp

Download

memory/2168-133-0x0000000005F20000-0x00000000064C4000-memory.dmp

Download

memory/3136-140-0x0000000006030000-0x0000000006096000-memory.dmp

Download

memory/3136-139-0x00000000058D0000-0x00000000058F2000-memory.dmp

Download

memory/3136-137-0x0000000005170000-0x00000000051A6000-memory.dmp

Download

memory/3136-138-0x0000000005910000-0x0000000005F38000-memory.dmp

Download

memory/3136-141-0x0000000006110000-0x0000000006176000-memory.dmp

Download

memory/3136-144-0x0000000006C10000-0x0000000006C2A000-memory.dmp

Download

memory/3136-143-0x0000000007DA0000-0x000000000841A000-memory.dmp

Download

memory/3136-142-0x0000000006730000-0x000000000674E000-memory.dmp

Download

memory/4640-154-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/4640-147-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/4640-149-0x0000000000400000-0x0000000000559000-memory.dmp

Download

memory/4640-150-0x0000000000400000-0x0000000000559000-memory.dmp

Download