warzonerat | 7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
27/10/2022, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 287KB
Sample221027-3atcdaecak
SHA256 7e96a60f26b252ef89a4e1f3fb4264f224031f6d8c9bc592f3ec715a3307c679
MD5 7170cc643a9c4b5e35cbff4fdff3a8d7
SHA1 d3395f2ff313f8fae082adad9d9e892b860eb747
SHA512 44662d34c37048a7fee0eb11e05818719a15afd618dfbe809c3eed1a903bd1df07eab1d90540e87390498c6b366a73719e7a1bda75a9d5eb4d712186f4436841
SSDEEP 6144:YVKVvfInUcpUm6KhJPWje13dCVdKrLXoJ8LL:DIUwdWjenCi/X1
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

chinagov.duckdns.org:5202

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/5100-139-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/5100-141-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/5100-143-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/5100-150-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systegbhhhm.exe	Powershell.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systegbhhhm.exe	Powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4016 set thread context of 5100	4016	file.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3592	Powershell.exe
3592	Powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4016	file.exe
Token: SeDebugPrivilege	3592	Powershell.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4016 wrote to memory of 3592	4016	file.exe	92
PID 4016 wrote to memory of 3592	4016	file.exe	92
PID 4016 wrote to memory of 3592	4016	file.exe	92
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94
PID 4016 wrote to memory of 5100	4016	file.exe	94

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4016
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe
  "Powershell" Copy-Item 'C:\Users\Admin\AppData\Local\Temp\file.exe' 'C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Systegbhhhm.exe'
  2⤵
  - Drops startup file
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3592
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:5100

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3592-145-0x00000000059D0000-0x0000000005A36000-memory.dmp

Download

memory/3592-146-0x0000000005FC0000-0x0000000005FDE000-memory.dmp

Download

memory/3592-136-0x00000000026B0000-0x00000000026E6000-memory.dmp

Download

memory/3592-149-0x0000000006510000-0x0000000006532000-memory.dmp

Download

memory/3592-148-0x0000000006470000-0x000000000648A000-memory.dmp

Download

memory/3592-138-0x0000000005160000-0x0000000005788000-memory.dmp

Download

memory/3592-147-0x0000000006FB0000-0x0000000007046000-memory.dmp

Download

memory/3592-142-0x00000000050F0000-0x0000000005112000-memory.dmp

Download

memory/3592-144-0x00000000058F0000-0x0000000005956000-memory.dmp

Download

memory/4016-134-0x0000000005CE0000-0x0000000006284000-memory.dmp

Download

memory/4016-133-0x0000000005650000-0x00000000056EC000-memory.dmp

Download

memory/4016-132-0x0000000000CD0000-0x0000000000D1C000-memory.dmp

Download

memory/5100-143-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5100-139-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5100-141-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/5100-150-0x0000000000400000-0x000000000055A000-memory.dmp

Download