warzonerat | 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056

Analysis

max time kernel
135s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
62d858df93a1ef71f5ed7ed1d8111395.exe
Size 2.5MB
Sample221014-cq92yscde4
SHA256 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056
MD5 62d858df93a1ef71f5ed7ed1d8111395
SHA1 5b0e71ff65b489438ccd4cd75fed0f848259511d
SHA512 ccfb0456b365fc0715dc3bf39bd838b8e8e16682bfe8dcc6f450236a73fffc0d52194fb59e7603da1627cade187add46e82ac490b2ff4c32e63da33298e2b481
SSDEEP 12288:scOdNT8feftQC9zoGzNkcOpHWbF6fa90osMjw:hUTtMXHWcMj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

192.3.111.154:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1020-55-0x00000000035A0000-0x00000000036F4000-memory.dmp	warzonerat
behavioral1/memory/1020-61-0x0000000002BA0000-0x00000000035A0000-memory.dmp	warzonerat
behavioral1/memory/2032-72-0x0000000003440000-0x0000000003594000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

pid	Process
2032	itunes.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	62d858df93a1ef71f5ed7ed1d8111395.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	62d858df93a1ef71f5ed7ed1d8111395.exe

Loads dropped DLL 1 IoCs

pid	Process
1020	62d858df93a1ef71f5ed7ed1d8111395.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\ProgramData\\itunes.exe"	62d858df93a1ef71f5ed7ed1d8111395.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	62d858df93a1ef71f5ed7ed1d8111395.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1736	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1736	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1736	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	27
PID 1020 wrote to memory of 1736	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	27
PID 1020 wrote to memory of 1736	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	27
PID 1020 wrote to memory of 1736	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	27
PID 1020 wrote to memory of 2032	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	29
PID 1020 wrote to memory of 2032	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	29
PID 1020 wrote to memory of 2032	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	29
PID 1020 wrote to memory of 2032	1020	62d858df93a1ef71f5ed7ed1d8111395.exe	29

C:\Users\Admin\AppData\Local\Temp\62d858df93a1ef71f5ed7ed1d8111395.exe
"C:\Users\Admin\AppData\Local\Temp\62d858df93a1ef71f5ed7ed1d8111395.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1736
- C:\ProgramData\itunes.exe
  "C:\ProgramData\itunes.exe"
  2⤵
  - Executes dropped EXE
  PID:2032

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

itunes.exe

Path C:\ProgramData\itunes.exe
Size 2.5MB
SHA256 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056
MD5 62d858df93a1ef71f5ed7ed1d8111395
SHA1 5b0e71ff65b489438ccd4cd75fed0f848259511d
SHA512 ccfb0456b365fc0715dc3bf39bd838b8e8e16682bfe8dcc6f450236a73fffc0d52194fb59e7603da1627cade187add46e82ac490b2ff4c32e63da33298e2b481
SSDEEP 12288:scOdNT8feftQC9zoGzNkcOpHWbF6fa90osMjw:hUTtMXHWcMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

itunes.exe

Path \ProgramData\itunes.exe
Size 2.5MB
SHA256 4d771099702b61244d44ce4d6c6ffdacd79bfead7b5774eb0ec8a1e7e9470056
MD5 62d858df93a1ef71f5ed7ed1d8111395
SHA1 5b0e71ff65b489438ccd4cd75fed0f848259511d
SHA512 ccfb0456b365fc0715dc3bf39bd838b8e8e16682bfe8dcc6f450236a73fffc0d52194fb59e7603da1627cade187add46e82ac490b2ff4c32e63da33298e2b481
SSDEEP 12288:scOdNT8feftQC9zoGzNkcOpHWbF6fa90osMjw:hUTtMXHWcMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1020-54-0x00000000762D1000-0x00000000762D3000-memory.dmp

Download

memory/1020-55-0x00000000035A0000-0x00000000036F4000-memory.dmp

Download

memory/1020-61-0x0000000002BA0000-0x00000000035A0000-memory.dmp

Download

memory/1736-70-0x0000000073FA0000-0x000000007454B000-memory.dmp

Download

memory/1736-71-0x0000000073FA0000-0x000000007454B000-memory.dmp

Download

memory/2032-72-0x0000000003440000-0x0000000003594000-memory.dmp

Download