warzonerat | 9d299bff3a3e78f7136c577564acd318345e6bb400a3c6c9fda75e3c1476a856

Analysis

max time kernel
140s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 293KB
Sample221027-3atcdadhh2
SHA256 9d299bff3a3e78f7136c577564acd318345e6bb400a3c6c9fda75e3c1476a856
MD5 7512087827c35d33ff03468850968b0e
SHA1 880db68b2ccf2361b5574e3e91cb914b5fd4c02d
SHA512 9c272b7aabc2f3a02192cede2aba6f131e94df688c45a18d82a2fd0f5b5a4a45847d510ef41042f7c132ef780f4fff6e9d5917285b1bce67624b501bcbacaf8d
SSDEEP 6144:ttMj4bNNWSsNWSfp3n3xedjCVdKrLGoJ8Ls:UcDUJp33GCi/GO
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

chinagov.duckdns.org:5202

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3832-139-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/3832-141-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/3832-146-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/3832-150-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systnsnsnsem.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systnsnsnsem.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4584 set thread context of 3832	4584	file.exe	90

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	Powershell.exe
3068	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	file.exe
Token: SeDebugPrivilege	3068	Powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 3068	4584	file.exe	88
PID 4584 wrote to memory of 3068	4584	file.exe	88
PID 4584 wrote to memory of 3068	4584	file.exe	88
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90
PID 4584 wrote to memory of 3832	4584	file.exe	90

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\file.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systnsnsnsem.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:3832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3068-145-0x0000000005EF0000-0x0000000005F0E000-memory.dmp

Download

memory/3068-143-0x00000000057F0000-0x0000000005856000-memory.dmp

Download

memory/3068-147-0x0000000006430000-0x00000000064C6000-memory.dmp

Download

memory/3068-136-0x00000000049A0000-0x00000000049D6000-memory.dmp

Download

memory/3068-138-0x0000000005010000-0x0000000005638000-memory.dmp

Download

memory/3068-148-0x00000000063C0000-0x00000000063DA000-memory.dmp

Download

memory/3068-149-0x0000000006E90000-0x0000000006EB2000-memory.dmp

Download

memory/3068-144-0x0000000005860000-0x00000000058C6000-memory.dmp

Download

memory/3068-142-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/3832-141-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3832-146-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3832-139-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3832-150-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/4584-133-0x0000000005640000-0x00000000056DC000-memory.dmp

Download

memory/4584-132-0x0000000000B70000-0x0000000000BBE000-memory.dmp

Download

memory/4584-134-0x0000000005C90000-0x0000000006234000-memory.dmp

Download