warzonerat | 76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

General

Target

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
Size

5.8MB
MD5

7d01ed506f8b0f279672828a3831ef7c
SHA1

8dcc4d789caefd438f44615059dc0f4f47fa29b0
SHA256

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5
SHA512

7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97
SSDEEP

98304:zpy6b+a439EQKfTRjX6+mv9CN5uoZI/Qm3nOR1ymm2iojZ/4vLp73lhjkE6RfAAX:zpy6Hf9jq+I9CFI5eG4Qp7LkEafAdo

Score

10^/10

warzonerat infostealer persistence rat vmprotect

Malware Config

Extracted

Family

warzonerat

C2

193.109.78.123:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/432-55-0x0000000000930000-0x00000000012A1000-memory.dmp	warzonerat
behavioral1/memory/432-57-0x0000000000930000-0x00000000012A1000-memory.dmp	warzonerat
behavioral1/memory/432-58-0x0000000000930000-0x00000000012A1000-memory.dmp	warzonerat
behavioral1/memory/432-64-0x0000000000930000-0x00000000012A1000-memory.dmp	warzonerat
behavioral1/memory/1880-66-0x0000000000310000-0x0000000000C81000-memory.dmp	warzonerat
behavioral1/memory/1880-68-0x0000000000310000-0x0000000000C81000-memory.dmp	warzonerat
behavioral1/memory/1880-71-0x0000000000310000-0x0000000000C81000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

Processes:

images.exe

pid process

1880 images.exe

pid	process
1880	images.exe

VMProtect packed file 11 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral1/memory/432-55-0x0000000000930000-0x00000000012A1000-memory.dmp	vmprotect
behavioral1/memory/432-57-0x0000000000930000-0x00000000012A1000-memory.dmp	vmprotect
behavioral1/memory/432-58-0x0000000000930000-0x00000000012A1000-memory.dmp	vmprotect
\ProgramData\images.exe	vmprotect
\ProgramData\images.exe	vmprotect
C:\ProgramData\images.exe	vmprotect
behavioral1/memory/432-64-0x0000000000930000-0x00000000012A1000-memory.dmp	vmprotect
C:\ProgramData\images.exe	vmprotect
behavioral1/memory/1880-66-0x0000000000310000-0x0000000000C81000-memory.dmp	vmprotect
behavioral1/memory/1880-68-0x0000000000310000-0x0000000000C81000-memory.dmp	vmprotect
behavioral1/memory/1880-71-0x0000000000310000-0x0000000000C81000-memory.dmp	vmprotect

Loads dropped DLL 2 IoCs

Processes:

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe

pid	process
432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exeimages.exe

pid	process
432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
1880	images.exe
1880	images.exe

Suspicious use of WriteProcessMemory 10 IoCs

Processes:

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exeimages.exe

description	pid	process	target process
PID 432 wrote to memory of 1880	432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe	images.exe
PID 432 wrote to memory of 1880	432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe	images.exe
PID 432 wrote to memory of 1880	432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe	images.exe
PID 432 wrote to memory of 1880	432	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe	images.exe
PID 1880 wrote to memory of 1808	1880	images.exe	cmd.exe
PID 1880 wrote to memory of 1808	1880	images.exe	cmd.exe
PID 1880 wrote to memory of 1808	1880	images.exe	cmd.exe
PID 1880 wrote to memory of 1808	1880	images.exe	cmd.exe
PID 1880 wrote to memory of 1808	1880	images.exe	cmd.exe
PID 1880 wrote to memory of 1808	1880	images.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
"C:\Users\Admin\AppData\Local\Temp\76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:432
- C:\ProgramData\images.exe
  "C:\ProgramData\images.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:1808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\images.exe

Filesize
5.8MB

MD5
7d01ed506f8b0f279672828a3831ef7c

SHA1
8dcc4d789caefd438f44615059dc0f4f47fa29b0

SHA256
76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

SHA512
7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97

Download Submit
C:\ProgramData\images.exe

Filesize
5.8MB

MD5
7d01ed506f8b0f279672828a3831ef7c

SHA1
8dcc4d789caefd438f44615059dc0f4f47fa29b0

SHA256
76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

SHA512
7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97

Download Submit
\ProgramData\images.exe

Filesize
5.8MB

MD5
7d01ed506f8b0f279672828a3831ef7c

SHA1
8dcc4d789caefd438f44615059dc0f4f47fa29b0

SHA256
76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

SHA512
7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97

Download Submit
\ProgramData\images.exe

Filesize
5.8MB

MD5
7d01ed506f8b0f279672828a3831ef7c

SHA1
8dcc4d789caefd438f44615059dc0f4f47fa29b0

SHA256
76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

SHA512
7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97

Download Submit
memory/432-58-0x0000000000930000-0x00000000012A1000-memory.dmp

Filesize
9.4MB

Download
memory/432-54-0x0000000076931000-0x0000000076933000-memory.dmp

Filesize
8KB

Download
memory/432-57-0x0000000000930000-0x00000000012A1000-memory.dmp

Filesize
9.4MB

Download
memory/432-64-0x0000000000930000-0x00000000012A1000-memory.dmp

Filesize
9.4MB

Download
memory/432-55-0x0000000000930000-0x00000000012A1000-memory.dmp

Filesize
9.4MB

Download
memory/1808-69-0x0000000000000000-mapping.dmp

Download
memory/1808-70-0x00000000001A0000-0x00000000001A1000-memory.dmp

Filesize
4KB

Download
memory/1880-61-0x0000000000000000-mapping.dmp

Download
memory/1880-66-0x0000000000310000-0x0000000000C81000-memory.dmp

Filesize
9.4MB

Download
memory/1880-68-0x0000000000310000-0x0000000000C81000-memory.dmp

Filesize
9.4MB

Download
memory/1880-71-0x0000000000310000-0x0000000000C81000-memory.dmp

Filesize
9.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads