warzonerat | 9d299bff3a3e78f7136c577564acd318345e6bb400a3c6c9fda75e3c1476a856

Analysis

max time kernel
124s
max time network
137s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 293KB
Sample221027-3atcdadhh2
SHA256 9d299bff3a3e78f7136c577564acd318345e6bb400a3c6c9fda75e3c1476a856
MD5 7512087827c35d33ff03468850968b0e
SHA1 880db68b2ccf2361b5574e3e91cb914b5fd4c02d
SHA512 9c272b7aabc2f3a02192cede2aba6f131e94df688c45a18d82a2fd0f5b5a4a45847d510ef41042f7c132ef780f4fff6e9d5917285b1bce67624b501bcbacaf8d
SSDEEP 6144:ttMj4bNNWSsNWSfp3n3xedjCVdKrLGoJ8Ls:UcDUJp33GCi/GO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

chinagov.duckdns.org:5202

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 9 IoCs

rat

resource	yara_rule
behavioral1/memory/984-65-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/984-66-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/984-68-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/984-70-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/984-71-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/984-72-0x0000000000406DA4-mapping.dmp	warzonerat
behavioral1/memory/984-75-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/984-76-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/984-79-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systnsnsnsem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systnsnsnsem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 112 set thread context of 984	112	file.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1140	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	112	file.exe
Token: SeDebugPrivilege	1140	Powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 112 wrote to memory of 1140	112	file.exe	27
PID 112 wrote to memory of 1140	112	file.exe	27
PID 112 wrote to memory of 1140	112	file.exe	27
PID 112 wrote to memory of 1140	112	file.exe	27
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29
PID 112 wrote to memory of 984	112	file.exe	29

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\file.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systnsnsnsem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1140
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:984

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/112-58-0x00000000005E0000-0x00000000005FC000-memory.dmp

Download

memory/112-55-0x0000000000AB0000-0x0000000000AEE000-memory.dmp

Download

memory/112-56-0x0000000074C11000-0x0000000074C13000-memory.dmp

Download

memory/112-54-0x0000000000BD0000-0x0000000000C1E000-memory.dmp

Download

memory/984-65-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-75-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-61-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-63-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-79-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-66-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-68-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-70-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-71-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-60-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/984-76-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/1140-77-0x0000000073E30000-0x00000000743DB000-memory.dmp

Download

memory/1140-78-0x0000000073E30000-0x00000000743DB000-memory.dmp

Download