warzonerat | 7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679

Analysis

max time kernel
138s
max time network
151s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
27/10/2022, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 287KB
Sample221027-3atcdaecak
SHA256 7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679
MD5 7170cc643a9c4b5e35cbff4fdff3a8d7
SHA1 d3395f2ff313f8fae082adad9d9e892b860eb747
SHA512 44662d34c37048a7fee0eb11e05818719a15afd618dfbe809c3eed1a903bd1df07eab1d90540e87390498c6b366a73719e7a1bda75a9d5eb4d712186f4436841
SSDEEP 6144:YVKVvfInUcpUm6KhJPWje13dCVdKrLXoJ8LL:DIUwdWjenCi/X1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

chinagov.duckdns.org:5202

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

resource	yara_rule
behavioral1/memory/2024-64-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2024-65-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2024-67-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2024-69-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2024-70-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2024-71-0x0000000000406DA4-mapping.dmp	warzonerat
behavioral1/memory/2024-74-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2024-76-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systegbhhhm.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systegbhhhm.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1936 set thread context of 2024	1936	file.exe	30

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1936	file.exe
Token: SeDebugPrivilege	2000	Powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2000	1936	file.exe	28
PID 1936 wrote to memory of 2000	1936	file.exe	28
PID 1936 wrote to memory of 2000	1936	file.exe	28
PID 1936 wrote to memory of 2000	1936	file.exe	28
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30
PID 1936 wrote to memory of 2024	1936	file.exe	30

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\file.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systegbhhhm.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2000
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:2024

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1936-54-0x0000000000340000-0x000000000038C000-memory.dmp

Download

memory/1936-55-0x0000000076DC1000-0x0000000076DC3000-memory.dmp

Download

memory/1936-57-0x0000000000300000-0x000000000031C000-memory.dmp

Download

memory/2000-77-0x00000000707D0000-0x0000000070D7B000-memory.dmp

Download

memory/2000-75-0x00000000707D0000-0x0000000070D7B000-memory.dmp

Download

memory/2024-65-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-64-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-62-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-67-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-69-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-70-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-74-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-60-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-76-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/2024-59-0x0000000000400000-0x000000000055A000-memory.dmp

Download