warzonerat | b878058400111ad01eb49ef0d08404c23f42bf2f6a81bdc2f152bef1fd16462e

Analysis

max time kernel
144s
max time network
148s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
14/10/2022, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58aa1601977688bea87b137d8fff8757.exe
Size 1.2MB
Sample221014-ej24wafdg9
SHA256 b878058400111ad01eb49ef0d08404c23f42bf2f6a81bdc2f152bef1fd16462e
MD5 58aa1601977688bea87b137d8fff8757
SHA1 ae3604560eed2eea86eaaa34233ee4cc79068e8c
SHA512 678d22ee2ccc993ec434074c6b03da7a9111fbd7d8a0365182e8e30fd4facbac9bba6e7772897c08ba9d429d2b0d3985767153f73356ba3d8e90a5605c70942c
SSDEEP 12288:+w6Nq9hrMqxN/xii2uuIp/2+nLuVW/b0D92G+MWudwJcNycN0F:hrMCN1IW/b0DQGRa3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

192.3.111.154:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral1/memory/1740-55-0x00000000028B0000-0x0000000002A04000-memory.dmp	warzonerat
behavioral1/memory/1740-61-0x0000000001EB0000-0x00000000028B0000-memory.dmp	warzonerat
behavioral1/memory/1052-71-0x0000000000550000-0x00000000006A4000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
1052	itunes.exe
340	Process not Found

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll"	itunes.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	58aa1601977688bea87b137d8fff8757.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	58aa1601977688bea87b137d8fff8757.exe

Loads dropped DLL 2 IoCs

pid	Process
1740	58aa1601977688bea87b137d8fff8757.exe
2032	Process not Found

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\conhost = "C:\\ProgramData\\itunes.exe"	58aa1601977688bea87b137d8fff8757.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	itunes.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	itunes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\Ip.Dkvc = "0"	itunes.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	itunes.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	itunes.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	itunes.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	itunes.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	58aa1601977688bea87b137d8fff8757.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
968	powershell.exe
1016	powershell.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
2032	Process not Found
2032	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	powershell.exe
Token: SeDebugPrivilege	1016	powershell.exe
Token: SeDebugPrivilege	1052	itunes.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1052	itunes.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 968	1740	58aa1601977688bea87b137d8fff8757.exe	27
PID 1740 wrote to memory of 968	1740	58aa1601977688bea87b137d8fff8757.exe	27
PID 1740 wrote to memory of 968	1740	58aa1601977688bea87b137d8fff8757.exe	27
PID 1740 wrote to memory of 968	1740	58aa1601977688bea87b137d8fff8757.exe	27
PID 1740 wrote to memory of 1052	1740	58aa1601977688bea87b137d8fff8757.exe	29
PID 1740 wrote to memory of 1052	1740	58aa1601977688bea87b137d8fff8757.exe	29
PID 1740 wrote to memory of 1052	1740	58aa1601977688bea87b137d8fff8757.exe	29
PID 1740 wrote to memory of 1052	1740	58aa1601977688bea87b137d8fff8757.exe	29
PID 1052 wrote to memory of 1016	1052	itunes.exe	30
PID 1052 wrote to memory of 1016	1052	itunes.exe	30
PID 1052 wrote to memory of 1016	1052	itunes.exe	30
PID 1052 wrote to memory of 1016	1052	itunes.exe	30
PID 1052 wrote to memory of 1152	1052	itunes.exe	31
PID 1052 wrote to memory of 1152	1052	itunes.exe	31
PID 1052 wrote to memory of 1152	1052	itunes.exe	31
PID 1052 wrote to memory of 1152	1052	itunes.exe	31
PID 1052 wrote to memory of 1152	1052	itunes.exe	31
PID 1052 wrote to memory of 1152	1052	itunes.exe	31

C:\Users\Admin\AppData\Local\Temp\58aa1601977688bea87b137d8fff8757.exe
"C:\Users\Admin\AppData\Local\Temp\58aa1601977688bea87b137d8fff8757.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:968
- C:\ProgramData\itunes.exe
  "C:\ProgramData\itunes.exe"
  2⤵
  - Executes dropped EXE
  - Sets DLL path for service in the registry
  - Modifies WinLogon
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1052
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1016
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1152

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

itunes.exe

Path C:\ProgramData\itunes.exe
Size 1.2MB
SHA256 b878058400111ad01eb49ef0d08404c23f42bf2f6a81bdc2f152bef1fd16462e
MD5 58aa1601977688bea87b137d8fff8757
SHA1 ae3604560eed2eea86eaaa34233ee4cc79068e8c
SHA512 678d22ee2ccc993ec434074c6b03da7a9111fbd7d8a0365182e8e30fd4facbac9bba6e7772897c08ba9d429d2b0d3985767153f73356ba3d8e90a5605c70942c
SSDEEP 12288:+w6Nq9hrMqxN/xii2uuIp/2+nLuVW/b0D92G+MWudwJcNycN0F:hrMCN1IW/b0DQGRa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

itunes.exe

Path C:\ProgramData\itunes.exe
Size 1.2MB
SHA256 b878058400111ad01eb49ef0d08404c23f42bf2f6a81bdc2f152bef1fd16462e
MD5 58aa1601977688bea87b137d8fff8757
SHA1 ae3604560eed2eea86eaaa34233ee4cc79068e8c
SHA512 678d22ee2ccc993ec434074c6b03da7a9111fbd7d8a0365182e8e30fd4facbac9bba6e7772897c08ba9d429d2b0d3985767153f73356ba3d8e90a5605c70942c
SSDEEP 12288:+w6Nq9hrMqxN/xii2uuIp/2+nLuVW/b0D92G+MWudwJcNycN0F:hrMCN1IW/b0DQGRa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 bc60a73702351c2825558f96b1cc658336a2179920d5297ed8d5b9a056483005
MD5 4c0efecdbdc3b8142ab1b929080ed6c9
SHA1 3c77a1f531c2c6e5fd7a0fe3cf1bc1cd2b750e07
SHA512 f9a1d97d6981e12e32dcf0b9c79170b4fbbfa6bf9502516fae557aea0745d8d4bb1c024e6db425d8122837182937ed74673d5e3edc020402dfd118c7cccc8617
SSDEEP 96:9dKC+M8VmnqvsqvJCwohdKC+M8VmnqvsEHyqvJCworNOZQpmQHg27lHmXlUVdl:/0MUo70MAHnorNO9h27lGIl
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlmap.dll

Path \Program Files\Microsoft DN1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlmap.dll

Path \Program Files\Microsoft DN1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

itunes.exe

Path \ProgramData\itunes.exe
Size 1.2MB
SHA256 b878058400111ad01eb49ef0d08404c23f42bf2f6a81bdc2f152bef1fd16462e
MD5 58aa1601977688bea87b137d8fff8757
SHA1 ae3604560eed2eea86eaaa34233ee4cc79068e8c
SHA512 678d22ee2ccc993ec434074c6b03da7a9111fbd7d8a0365182e8e30fd4facbac9bba6e7772897c08ba9d429d2b0d3985767153f73356ba3d8e90a5605c70942c
SSDEEP 12288:+w6Nq9hrMqxN/xii2uuIp/2+nLuVW/b0D92G+MWudwJcNycN0F:hrMCN1IW/b0DQGRa3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/968-68-0x00000000739F0000-0x0000000073F9B000-memory.dmp

Download

memory/968-69-0x00000000739F0000-0x0000000073F9B000-memory.dmp

Download

memory/1016-82-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Download

memory/1016-83-0x00000000736D0000-0x0000000073C7B000-memory.dmp

Download

memory/1052-71-0x0000000000550000-0x00000000006A4000-memory.dmp

Download

memory/1052-86-0x00000000045A0000-0x00000000046A0000-memory.dmp

Download

memory/1152-84-0x0000000000260000-0x0000000000261000-memory.dmp

Download

memory/1740-54-0x0000000075931000-0x0000000075933000-memory.dmp

Download

memory/1740-61-0x0000000001EB0000-0x00000000028B0000-memory.dmp

Download

memory/1740-55-0x00000000028B0000-0x0000000002A04000-memory.dmp

Download