warzonerat | 0ef9a5163ff41cc93ce7ad3ae8501298ac75eacfbd8395d3ae3f72b2586b746f

General

Target

75819abac26d3f25688715697c14ea10.exe
Size

803KB
MD5

75819abac26d3f25688715697c14ea10
SHA1

2be013e7f9988bf6c00193d1479a276d080fabcc
SHA256

0ef9a5163ff41cc93ce7ad3ae8501298ac75eacfbd8395d3ae3f72b2586b746f
SHA512

33b257d5dd4c89bf2326d76e84604c3d1dfc0e34201ae01d4d3846173da6eafcbe472588f9d503bad2f40cc15968dfedac3cf5316cdb31b0f03bcbdbac02e328
SSDEEP

12288:2oAviU251k9btMOKdACf8uHts5oegqVBQva5TsyhdgxJU25:2oAxoOhMVAZuHG5XbyiKEKk25

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

newvic.myvnc.com:4157

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4060-138-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4060-140-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4060-141-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4060-145-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4744-150-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4744-151-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4744-154-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

Processes:

images.exeimages.exe

pid process

2232 images.exe
4744 images.exe

pid	process
2232	images.exe
4744	images.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

75819abac26d3f25688715697c14ea10.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	75819abac26d3f25688715697c14ea10.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

75819abac26d3f25688715697c14ea10.exeimages.exe

description	pid	process	target process
PID 4828 set thread context of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 2232 set thread context of 4744	2232	images.exe	images.exe

Suspicious use of WriteProcessMemory 30 IoCs

Processes:

75819abac26d3f25688715697c14ea10.exe75819abac26d3f25688715697c14ea10.exeimages.exeimages.exe

description	pid	process	target process
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4828 wrote to memory of 4060	4828	75819abac26d3f25688715697c14ea10.exe	75819abac26d3f25688715697c14ea10.exe
PID 4060 wrote to memory of 2232	4060	75819abac26d3f25688715697c14ea10.exe	images.exe
PID 4060 wrote to memory of 2232	4060	75819abac26d3f25688715697c14ea10.exe	images.exe
PID 4060 wrote to memory of 2232	4060	75819abac26d3f25688715697c14ea10.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 2232 wrote to memory of 4744	2232	images.exe	images.exe
PID 4744 wrote to memory of 1592	4744	images.exe	cmd.exe
PID 4744 wrote to memory of 1592	4744	images.exe	cmd.exe
PID 4744 wrote to memory of 1592	4744	images.exe	cmd.exe
PID 4744 wrote to memory of 1592	4744	images.exe	cmd.exe
PID 4744 wrote to memory of 1592	4744	images.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\75819abac26d3f25688715697c14ea10.exe
"C:\Users\Admin\AppData\Local\Temp\75819abac26d3f25688715697c14ea10.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Users\Admin\AppData\Local\Temp\75819abac26d3f25688715697c14ea10.exe
  "{path}"
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2232
  - - C:\ProgramData\images.exe
      "{path}"
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4744
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\images.exe

Filesize
803KB

MD5
75819abac26d3f25688715697c14ea10

SHA1
2be013e7f9988bf6c00193d1479a276d080fabcc

SHA256
0ef9a5163ff41cc93ce7ad3ae8501298ac75eacfbd8395d3ae3f72b2586b746f

SHA512
33b257d5dd4c89bf2326d76e84604c3d1dfc0e34201ae01d4d3846173da6eafcbe472588f9d503bad2f40cc15968dfedac3cf5316cdb31b0f03bcbdbac02e328

Download Submit
C:\ProgramData\images.exe

Filesize
803KB

MD5
75819abac26d3f25688715697c14ea10

SHA1
2be013e7f9988bf6c00193d1479a276d080fabcc

SHA256
0ef9a5163ff41cc93ce7ad3ae8501298ac75eacfbd8395d3ae3f72b2586b746f

SHA512
33b257d5dd4c89bf2326d76e84604c3d1dfc0e34201ae01d4d3846173da6eafcbe472588f9d503bad2f40cc15968dfedac3cf5316cdb31b0f03bcbdbac02e328

Download Submit
C:\ProgramData\images.exe

Filesize
803KB

MD5
75819abac26d3f25688715697c14ea10

SHA1
2be013e7f9988bf6c00193d1479a276d080fabcc

SHA256
0ef9a5163ff41cc93ce7ad3ae8501298ac75eacfbd8395d3ae3f72b2586b746f

SHA512
33b257d5dd4c89bf2326d76e84604c3d1dfc0e34201ae01d4d3846173da6eafcbe472588f9d503bad2f40cc15968dfedac3cf5316cdb31b0f03bcbdbac02e328

Download Submit
memory/1592-153-0x0000000000EF0000-0x0000000000EF1000-memory.dmp

Filesize
4KB

Download
memory/1592-152-0x0000000000000000-mapping.dmp

Download
memory/2232-142-0x0000000000000000-mapping.dmp

Download
memory/4060-137-0x0000000000000000-mapping.dmp

Download
memory/4060-145-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4060-141-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4060-138-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4060-140-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4744-151-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4744-146-0x0000000000000000-mapping.dmp

Download
memory/4744-150-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4744-154-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/4828-136-0x0000000005A50000-0x0000000005A5A000-memory.dmp

Filesize
40KB

Download
memory/4828-135-0x0000000005B40000-0x0000000005BDC000-memory.dmp

Filesize
624KB

Download
memory/4828-132-0x0000000000FF0000-0x00000000010C0000-memory.dmp

Filesize
832KB

Download
memory/4828-134-0x0000000005AA0000-0x0000000005B32000-memory.dmp

Filesize
584KB

Download
memory/4828-133-0x0000000006050000-0x00000000065F4000-memory.dmp

Filesize
5.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads