warzonerat | e85f5454f2eecdd3e4ddfbf9711471072afbce4b6c5fc5d58fabcc5c975722ae

Analysis

max time kernel
151s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31/10/2022, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
309c42fc6e92695fd99c8c1594ac31d0.exe
Size 541KB
Sample221031-hr3bdsbbdj
SHA256 e85f5454f2eecdd3e4ddfbf9711471072afbce4b6c5fc5d58fabcc5c975722ae
MD5 309c42fc6e92695fd99c8c1594ac31d0
SHA1 313e24d80dbeb4b34c61afda79ddbbee510b2766
SHA512 fdee54c8bbadfb3824510a54d32ac39abf3116a60974361abc15672ea89999b71ff727bc54dda92e2d718aa31e41ff3982f0feff0001e3895fb1d8c33bd82f88
SSDEEP 12288:Ph7Dyt9uLlHw2K0k2blA8j/DZiKueA7RmHDEyL:Zyt9uVKOl/j/liKue4RmjEyL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

resource	yara_rule
behavioral2/memory/4496-137-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/4496-139-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/4496-140-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/4496-144-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/3616-149-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/3616-150-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/3616-153-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
4760	images.exe
3616	images.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe"	309c42fc6e92695fd99c8c1594ac31d0.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1284 set thread context of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 4760 set thread context of 3616	4760	images.exe	88

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 1284 wrote to memory of 4496	1284	309c42fc6e92695fd99c8c1594ac31d0.exe	86
PID 4496 wrote to memory of 4760	4496	309c42fc6e92695fd99c8c1594ac31d0.exe	87
PID 4496 wrote to memory of 4760	4496	309c42fc6e92695fd99c8c1594ac31d0.exe	87
PID 4496 wrote to memory of 4760	4496	309c42fc6e92695fd99c8c1594ac31d0.exe	87
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 4760 wrote to memory of 3616	4760	images.exe	88
PID 3616 wrote to memory of 3596	3616	images.exe	89
PID 3616 wrote to memory of 3596	3616	images.exe	89
PID 3616 wrote to memory of 3596	3616	images.exe	89
PID 3616 wrote to memory of 3596	3616	images.exe	89
PID 3616 wrote to memory of 3596	3616	images.exe	89

C:\Users\Admin\AppData\Local\Temp\309c42fc6e92695fd99c8c1594ac31d0.exe
"C:\Users\Admin\AppData\Local\Temp\309c42fc6e92695fd99c8c1594ac31d0.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\309c42fc6e92695fd99c8c1594ac31d0.exe
  "C:\Users\Admin\AppData\Local\Temp\309c42fc6e92695fd99c8c1594ac31d0.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4496
- - C:\Users\Admin\Documents\images.exe
    "C:\Users\Admin\Documents\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Users\Admin\Documents\images.exe
      "C:\Users\Admin\Documents\images.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:3616
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:3596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

images.exe

Path C:\Users\Admin\Documents\images.exe
Size 541KB
SHA256 e85f5454f2eecdd3e4ddfbf9711471072afbce4b6c5fc5d58fabcc5c975722ae
MD5 309c42fc6e92695fd99c8c1594ac31d0
SHA1 313e24d80dbeb4b34c61afda79ddbbee510b2766
SHA512 fdee54c8bbadfb3824510a54d32ac39abf3116a60974361abc15672ea89999b71ff727bc54dda92e2d718aa31e41ff3982f0feff0001e3895fb1d8c33bd82f88
SSDEEP 12288:Ph7Dyt9uLlHw2K0k2blA8j/DZiKueA7RmHDEyL:Zyt9uVKOl/j/liKue4RmjEyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

images.exe

Path C:\Users\Admin\Documents\images.exe
Size 541KB
SHA256 e85f5454f2eecdd3e4ddfbf9711471072afbce4b6c5fc5d58fabcc5c975722ae
MD5 309c42fc6e92695fd99c8c1594ac31d0
SHA1 313e24d80dbeb4b34c61afda79ddbbee510b2766
SHA512 fdee54c8bbadfb3824510a54d32ac39abf3116a60974361abc15672ea89999b71ff727bc54dda92e2d718aa31e41ff3982f0feff0001e3895fb1d8c33bd82f88
SSDEEP 12288:Ph7Dyt9uLlHw2K0k2blA8j/DZiKueA7RmHDEyL:Zyt9uVKOl/j/liKue4RmjEyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

images.exe

Path C:\Users\Admin\Documents\images.exe
Size 541KB
SHA256 e85f5454f2eecdd3e4ddfbf9711471072afbce4b6c5fc5d58fabcc5c975722ae
MD5 309c42fc6e92695fd99c8c1594ac31d0
SHA1 313e24d80dbeb4b34c61afda79ddbbee510b2766
SHA512 fdee54c8bbadfb3824510a54d32ac39abf3116a60974361abc15672ea89999b71ff727bc54dda92e2d718aa31e41ff3982f0feff0001e3895fb1d8c33bd82f88
SSDEEP 12288:Ph7Dyt9uLlHw2K0k2blA8j/DZiKueA7RmHDEyL:Zyt9uVKOl/j/liKue4RmjEyL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1284-133-0x00000000060C0000-0x0000000006664000-memory.dmp

Download

memory/1284-134-0x0000000005B10000-0x0000000005BA2000-memory.dmp

Download

memory/1284-135-0x0000000005FD0000-0x000000000606C000-memory.dmp

Download

memory/1284-132-0x0000000000F00000-0x0000000000F8E000-memory.dmp

Download

memory/3596-152-0x0000000001020000-0x0000000001021000-memory.dmp

Download

memory/3616-149-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/3616-150-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/3616-153-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/4496-144-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/4496-140-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/4496-139-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/4496-137-0x0000000000400000-0x0000000000568000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads