warzonerat | 2db9768efcf9026fd5c979e9802aa1e2cdec6bebb0815aea8a77d664bde1d8ae

Analysis

max time kernel
208s
max time network
267s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20/10/2022, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00f967c1848688151db02d2186ee0f94.exe
Size 368KB
Sample221020-2fcq5shcdn
SHA256 2db9768efcf9026fd5c979e9802aa1e2cdec6bebb0815aea8a77d664bde1d8ae
MD5 00f967c1848688151db02d2186ee0f94
SHA1 a9234f0205a9d178af5f366329323e3da85c4a12
SHA512 0683743b6a9f4b98a2027021d7f102a4c47e64f1103844c1d0e5d6ad2000ccbf68737ae8d22e74e8120ee5d7eaddb5344afc828034c63a7fed5c8826d48ee5cf
SSDEEP 6144:GbE/HUR5waVgIX7A7ZAjHE6N39OEZ8eZQ5K:GbkZh6N39dZQ5K
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

steam007.duckdns.org:6548

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4600-142-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 4 IoCs

pid	Process
544	jzoet.exe
1184	jzoet.exe
2808	jzoet.exe
4064	jzoet.exe

Loads dropped DLL 1 IoCs

pid	Process
4600	jzoet.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\abldyhywix = "C:\\Users\\Admin\\AppData\\Roaming\\omvjtfgw\\kqly.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\jzoet.exe\""	jzoet.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 544 set thread context of 4600	544	jzoet.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
872	544	WerFault.exe	81

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4600	jzoet.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 544	4960	00f967c1848688151db02d2186ee0f94.exe	81
PID 4960 wrote to memory of 544	4960	00f967c1848688151db02d2186ee0f94.exe	81
PID 4960 wrote to memory of 544	4960	00f967c1848688151db02d2186ee0f94.exe	81
PID 544 wrote to memory of 1184	544	jzoet.exe	82
PID 544 wrote to memory of 1184	544	jzoet.exe	82
PID 544 wrote to memory of 1184	544	jzoet.exe	82
PID 544 wrote to memory of 2808	544	jzoet.exe	83
PID 544 wrote to memory of 2808	544	jzoet.exe	83
PID 544 wrote to memory of 2808	544	jzoet.exe	83
PID 544 wrote to memory of 4064	544	jzoet.exe	84
PID 544 wrote to memory of 4064	544	jzoet.exe	84
PID 544 wrote to memory of 4064	544	jzoet.exe	84
PID 544 wrote to memory of 4600	544	jzoet.exe	85
PID 544 wrote to memory of 4600	544	jzoet.exe	85
PID 544 wrote to memory of 4600	544	jzoet.exe	85
PID 544 wrote to memory of 4600	544	jzoet.exe	85

C:\Users\Admin\AppData\Local\Temp\00f967c1848688151db02d2186ee0f94.exe
"C:\Users\Admin\AppData\Local\Temp\00f967c1848688151db02d2186ee0f94.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\jzoet.exe
  "C:\Users\Admin\AppData\Local\Temp\jzoet.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Users\Admin\AppData\Local\Temp\jzoet.exe
    "C:\Users\Admin\AppData\Local\Temp\jzoet.exe"
    3⤵
    - Executes dropped EXE
    PID:1184
- - C:\Users\Admin\AppData\Local\Temp\jzoet.exe
    "C:\Users\Admin\AppData\Local\Temp\jzoet.exe"
    3⤵
    - Executes dropped EXE
    PID:2808
- - C:\Users\Admin\AppData\Local\Temp\jzoet.exe
    "C:\Users\Admin\AppData\Local\Temp\jzoet.exe"
    3⤵
    - Executes dropped EXE
    PID:4064
- - C:\Users\Admin\AppData\Local\Temp\jzoet.exe
    "C:\Users\Admin\AppData\Local\Temp\jzoet.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of SetWindowsHookEx
    PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 676
    3⤵
    - Program crash
    PID:872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 544 -ip 544
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jzoet.exe

Path C:\Users\Admin\AppData\Local\Temp\jzoet.exe
Size 59KB
SHA256 d89babd3df38be3b3e979c16d5df8e7bc1565daed23bbeeb8dec63b1fbf8826f
MD5 0381f8157ee351ae9450f57ca2c5370f
SHA1 86da936390cb5435f6252c645b57b31e0fd9a0a9
SHA512 e402b41bb599ea9c06337e1fae9f211668d76e1feb1aa422ba9e65bc49674327c810e5e83c4bae296628727dcc33d759dcc49fd824599e1ac6434f1b3df35ea8
SSDEEP 1536:8vtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:8CsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzoet.exe

Path C:\Users\Admin\AppData\Local\Temp\jzoet.exe
Size 59KB
SHA256 d89babd3df38be3b3e979c16d5df8e7bc1565daed23bbeeb8dec63b1fbf8826f
MD5 0381f8157ee351ae9450f57ca2c5370f
SHA1 86da936390cb5435f6252c645b57b31e0fd9a0a9
SHA512 e402b41bb599ea9c06337e1fae9f211668d76e1feb1aa422ba9e65bc49674327c810e5e83c4bae296628727dcc33d759dcc49fd824599e1ac6434f1b3df35ea8
SSDEEP 1536:8vtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:8CsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzoet.exe

Path C:\Users\Admin\AppData\Local\Temp\jzoet.exe
Size 59KB
SHA256 d89babd3df38be3b3e979c16d5df8e7bc1565daed23bbeeb8dec63b1fbf8826f
MD5 0381f8157ee351ae9450f57ca2c5370f
SHA1 86da936390cb5435f6252c645b57b31e0fd9a0a9
SHA512 e402b41bb599ea9c06337e1fae9f211668d76e1feb1aa422ba9e65bc49674327c810e5e83c4bae296628727dcc33d759dcc49fd824599e1ac6434f1b3df35ea8
SSDEEP 1536:8vtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:8CsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzoet.exe

Path C:\Users\Admin\AppData\Local\Temp\jzoet.exe
Size 59KB
SHA256 d89babd3df38be3b3e979c16d5df8e7bc1565daed23bbeeb8dec63b1fbf8826f
MD5 0381f8157ee351ae9450f57ca2c5370f
SHA1 86da936390cb5435f6252c645b57b31e0fd9a0a9
SHA512 e402b41bb599ea9c06337e1fae9f211668d76e1feb1aa422ba9e65bc49674327c810e5e83c4bae296628727dcc33d759dcc49fd824599e1ac6434f1b3df35ea8
SSDEEP 1536:8vtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:8CsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzoet.exe

Path C:\Users\Admin\AppData\Local\Temp\jzoet.exe
Size 59KB
SHA256 d89babd3df38be3b3e979c16d5df8e7bc1565daed23bbeeb8dec63b1fbf8826f
MD5 0381f8157ee351ae9450f57ca2c5370f
SHA1 86da936390cb5435f6252c645b57b31e0fd9a0a9
SHA512 e402b41bb599ea9c06337e1fae9f211668d76e1feb1aa422ba9e65bc49674327c810e5e83c4bae296628727dcc33d759dcc49fd824599e1ac6434f1b3df35ea8
SSDEEP 1536:8vtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:8CsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

jzoet.exe

Path C:\Users\Admin\AppData\Local\Temp\jzoet.exe
Size 59KB
SHA256 d89babd3df38be3b3e979c16d5df8e7bc1565daed23bbeeb8dec63b1fbf8826f
MD5 0381f8157ee351ae9450f57ca2c5370f
SHA1 86da936390cb5435f6252c645b57b31e0fd9a0a9
SHA512 e402b41bb599ea9c06337e1fae9f211668d76e1feb1aa422ba9e65bc49674327c810e5e83c4bae296628727dcc33d759dcc49fd824599e1ac6434f1b3df35ea8
SSDEEP 1536:8vtLu0ZssXg2J2m3K5n2ETMCZQsuyXn5QnQC:8CsPEvMCi32nCnQC
MD5 SHA1 SHA512 SSDEEP

Submit Download

tiwukdfrkx.t

Path C:\Users\Admin\AppData\Local\Temp\tiwukdfrkx.t
Size 6KB
SHA256 1b19cc3d957c7490f60d0fa8898e28fa427372f1d99ad4f4ba8d04111d0b157c
MD5 50e6da9bbfea07072c36aae27e754215
SHA1 9a9b774e8fffabd909ba1c04dc85de1131320cea
SHA512 4370ee2898b19077b493e8e0eb30b17fe8ec31c56c81efc7d441baa2fa3895b7707aba4de7f432993b526f39b704891e624ebca9111321ad6706729b77d23b8a
SSDEEP 192:z5r4XiS0YPA+z/TdjFjQNDJGr+8aOkJvGWF:z6hIiSDkq8aOnWF
MD5 SHA1 SHA512 SSDEEP

Submit Download

vjeai.zvy

Path C:\Users\Admin\AppData\Local\Temp\vjeai.zvy
Size 98KB
SHA256 5cac4e430479fe66af57cd0730399e25bcf36cc72f8665f0a11d34703df03bba
MD5 9dbc98df13f5bb6852f258d09d110f4d
SHA1 8a78e52b47fdcf43f8e186b8f7b141389682e077
SHA512 8cb4746c85e562c7e03f592e12e8c33391e9d31e1d41dceb548eaa3cb6f9a483d94c820cb5070e65c0fdd5198a860eee3345e507fdf5ae6d56e5d4dc82e376bc
SSDEEP 1536:Zvkg+9jfEVhEOzfekp65L6loU/RSatFO1G0d0pFRuIkA1Qqi6ARa3e28:Zkg+9jfEVheG6M7NFO1GjpFudN6Avn
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4600-142-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads