warzonerat | 842fc15b363a849a21ce37a22bd237371576a0a92adc3718adce933dfbb16f83

Resubmissions

29-11-2022 08:35

29-11-2022 08:16

max time kernel
138s
max time network
196s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:16

Target

new.exe
Size

2.3MB
MD5

574e031a4747d5e6315b894f983d3001
SHA1

30222efc71057a20e085b757c7eadb75ee50b155
SHA256

842fc15b363a849a21ce37a22bd237371576a0a92adc3718adce933dfbb16f83
SHA512

7a204e8f508e5e0d0f798f996d53e301d8bc330b86f26dab55ed22495c4ed09c0bc149c2e7857cc1fa68f0e118092b8c9f1ab8d321540c8277fcfd52b76226a1
SSDEEP

12288:2YSJAsjzCjawSIIgH8n7XAW76XcpjvV653IDqYheWiYWZaQKjYD:6JAsjvI

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1208-55-0x0000000002300000-0x0000000002D00000-memory.dmp	warzonerat
behavioral1/memory/1208-56-0x0000000000910000-0x0000000000A78000-memory.dmp	warzonerat

Drops startup file 2 IoCs

Processes:

new.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	new.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	new.exe

NTFS ADS 2 IoCs

Processes:

new.exe

description	ioc	process
File created	C:\Users\Admin\Documents\Documents:ApplicationData	new.exe
File opened for modification	C:\Users\Admin\Documents\Documents:ApplicationData	new.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

powershell.exe

pid process

1108 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1108 powershell.exe

pid	process
1108	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1108	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

new.exe

description	pid	process	target process
PID 1208 wrote to memory of 1108	1208	new.exe	powershell.exe
PID 1208 wrote to memory of 1108	1208	new.exe	powershell.exe
PID 1208 wrote to memory of 1108	1208	new.exe	powershell.exe
PID 1208 wrote to memory of 1108	1208	new.exe	powershell.exe

memory/1108-62-0x0000000000000000-mapping.dmp

Download
memory/1108-64-0x00000000732F0000-0x000000007389B000-memory.dmp

Filesize
5.7MB

Download
memory/1108-65-0x00000000732F0000-0x000000007389B000-memory.dmp

Filesize
5.7MB

Download
memory/1208-54-0x0000000075F51000-0x0000000075F53000-memory.dmp

Filesize
8KB

Download
memory/1208-55-0x0000000002300000-0x0000000002D00000-memory.dmp

Filesize
10.0MB

Download
memory/1208-56-0x0000000000910000-0x0000000000A78000-memory.dmp

Filesize
1.4MB

Download