warzonerat | 2f819035f40d57ed47842a2437873b201ef3dc2ce90f4efba62ea22f6dd76a0c

General

Target
2510019c3b7c8f38d39b839952ead713.exe
Size 330KB
Sample221102-tgr88aaba4
SHA256 2f819035f40d57ed47842a2437873b201ef3dc2ce90f4efba62ea22f6dd76a0c
MD5 2510019c3b7c8f38d39b839952ead713
SHA1 93c0eb59508c1113002c72af560c31b3acc13fb5
SHA512 8192f11512c8c5d35252d55ca98c6f5504226da0ac31083685b9576ad781b806858b15e8384f00c2cc17e7c72d55348a51229d9cd65359416c375fdd75dc32ae
SSDEEP 6144:7weEHEUAW/l3kYbv8bWGm49P9g3NBQKi5W:e4Q8bA49P9SNBcW
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

workbro.duckdns.org:1992

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2232-139-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/2232-140-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
4768	nwkveh.exe
2232	nwkveh.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rvnuh = "C:\\Users\\Admin\\AppData\\Roaming\\uguf\\mcxvwbpaorr.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\nwkveh.exe\""	nwkveh.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4768 set thread context of 2232	4768	nwkveh.exe	81

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4768	nwkveh.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2232	nwkveh.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4788 wrote to memory of 4768	4788	2510019c3b7c8f38d39b839952ead713.exe	80
PID 4788 wrote to memory of 4768	4788	2510019c3b7c8f38d39b839952ead713.exe	80
PID 4788 wrote to memory of 4768	4788	2510019c3b7c8f38d39b839952ead713.exe	80
PID 4768 wrote to memory of 2232	4768	nwkveh.exe	81
PID 4768 wrote to memory of 2232	4768	nwkveh.exe	81
PID 4768 wrote to memory of 2232	4768	nwkveh.exe	81
PID 4768 wrote to memory of 2232	4768	nwkveh.exe	81

C:\Users\Admin\AppData\Local\Temp\2510019c3b7c8f38d39b839952ead713.exe
"C:\Users\Admin\AppData\Local\Temp\2510019c3b7c8f38d39b839952ead713.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4788
- C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
  "C:\Users\Admin\AppData\Local\Temp\nwkveh.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
    "C:\Users\Admin\AppData\Local\Temp\nwkveh.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2232

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

gprutb.vx

Path C:\Users\Admin\AppData\Local\Temp\gprutb.vx
Size 98KB
SHA256 3414d5e48672b345e155cd957aec8f876e1e297dc956ec789ba43f9405e384e3
MD5 b27fd23a637e3b1d321c38831b0f1e6f
SHA1 4bd890ec74d2760fcdc68331dab91b6da5adac94
SHA512 86079e96ad2a470e8f6e5633af822d899b92e596ef6399d08a36b9769a379f4fed2e4c1035d5f269853bdae24fcb8ca428058a2323812b47acfa7fc492616487
SSDEEP 1536:WWJpyKc134sOpo3Xt2HJuNTNbMifakUgvsHCmzL4wFGIqxxbCYhSmsVc+TsFFyF3:WEpy1CH0RikUgFzIoxbCYhzH4J7
MD5 SHA1 SHA512 SSDEEP

Submit Download

iopmkjx.d

Path C:\Users\Admin\AppData\Local\Temp\iopmkjx.d
Size 7KB
SHA256 dd7d9b15aa8f85adbe79f5c60c85d6c169c2166a4bbd006ee8bbf449fca83079
MD5 6314f9313bc0ab759562593970003a23
SHA1 69e6b0607400e216ae1eff93945c804a00ec5544
SHA512 4b2982ac0f9d2801ab63f775e6d928d6c0b5c2f856515f4a20594ff1995cdef11c56b5f5455aa71d45b28c092e06d1e7e21f5570778a2e909d8f86daf5dc5b96
SSDEEP 192:QwIpGKXmqhJAbF6PVr97o5gowXm72dRl2Bww+/D3afBvy+jUinDhzE04S:QwexXm2AbulA8maPY7fRVzNkS
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

nwkveh.exe

Path C:\Users\Admin\AppData\Local\Temp\nwkveh.exe
Size 8KB
SHA256 85920964b537d2002890cf2d0a25fdc1cd7904bbcbcae4c11551d5042276113f
MD5 4761302d6f0f8ba4fedd5245b9a42356
SHA1 56aac2cfceb15087925cc3fe91848c29671b0511
SHA512 c873ae2e336419ac3839f8643247e705c2cd3c42f209c0a111313debe215becacafbd449dbbc643218a36050360ae6dea94eb41eebb3a5a2706d205b47f15b1e
SSDEEP 96:Bodi6id99bx7D9g3Zc04zKQPl2VBtBd1uwmXNOqjCX9VRo:+dF+9nn9gpz4GQ6Dn1uVbjCXP
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2232-139-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/2232-140-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads