warzonerat | 76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

General

Target

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
Size

5.8MB
MD5

7d01ed506f8b0f279672828a3831ef7c
SHA1

8dcc4d789caefd438f44615059dc0f4f47fa29b0
SHA256

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5
SHA512

7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97
SSDEEP

98304:zpy6b+a439EQKfTRjX6+mv9CN5uoZI/Qm3nOR1ymm2iojZ/4vLp73lhjkE6RfAAX:zpy6Hf9jq+I9CFI5eG4Qp7LkEafAdo

Score

10^/10

warzonerat infostealer persistence rat vmprotect

Malware Config

Extracted

Family

warzonerat

C2

193.109.78.123:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 5 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/2284-132-0x00000000009A0000-0x0000000001311000-memory.dmp	warzonerat
behavioral2/memory/2284-134-0x00000000009A0000-0x0000000001311000-memory.dmp	warzonerat
behavioral2/memory/2284-138-0x00000000009A0000-0x0000000001311000-memory.dmp	warzonerat
behavioral2/memory/4568-139-0x00000000005C0000-0x0000000000F31000-memory.dmp	warzonerat
behavioral2/memory/4568-143-0x00000000005C0000-0x0000000000F31000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

Processes:

images.exe

pid process

4568 images.exe

pid	process
4568	images.exe

VMProtect packed file 7 IoCs

Detects executables packed with VMProtect commercial packer.

vmprotect

Processes:

resource	yara_rule
behavioral2/memory/2284-132-0x00000000009A0000-0x0000000001311000-memory.dmp	vmprotect
behavioral2/memory/2284-134-0x00000000009A0000-0x0000000001311000-memory.dmp	vmprotect
C:\ProgramData\images.exe	vmprotect
C:\ProgramData\images.exe	vmprotect
behavioral2/memory/2284-138-0x00000000009A0000-0x0000000001311000-memory.dmp	vmprotect
behavioral2/memory/4568-139-0x00000000005C0000-0x0000000000F31000-memory.dmp	vmprotect
behavioral2/memory/4568-143-0x00000000005C0000-0x0000000000F31000-memory.dmp	vmprotect

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exeimages.exe

pid	process
2284	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
2284	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
2284	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
2284	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
4568	images.exe
4568	images.exe
4568	images.exe
4568	images.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exeimages.exe

description	pid	process	target process
PID 2284 wrote to memory of 4568	2284	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe	images.exe
PID 2284 wrote to memory of 4568	2284	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe	images.exe
PID 2284 wrote to memory of 4568	2284	76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe	images.exe
PID 4568 wrote to memory of 2480	4568	images.exe	cmd.exe
PID 4568 wrote to memory of 2480	4568	images.exe	cmd.exe
PID 4568 wrote to memory of 2480	4568	images.exe	cmd.exe
PID 4568 wrote to memory of 2480	4568	images.exe	cmd.exe
PID 4568 wrote to memory of 2480	4568	images.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe
"C:\Users\Admin\AppData\Local\Temp\76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2284

C:\ProgramData\images.exe
"C:\ProgramData\images.exe"
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4568

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:2480

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\images.exe
Filesize
5.8MB

MD5
7d01ed506f8b0f279672828a3831ef7c

SHA1
8dcc4d789caefd438f44615059dc0f4f47fa29b0

SHA256
76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

SHA512
7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97

Download Submit
C:\ProgramData\images.exe
Filesize
5.8MB

MD5
7d01ed506f8b0f279672828a3831ef7c

SHA1
8dcc4d789caefd438f44615059dc0f4f47fa29b0

SHA256
76acd3058c0b09c8bd34be9fe13999cf7d34009154888e276d93a0702ed234f5

SHA512
7ad7764dd2de059d40058d577d88a7d4bb65e491bdc8773b80c553f26c960b629e482abbee74973f7b4cc809e555d74c9388990607822682b302148da3ebda97

Download Submit
memory/2284-132-0x00000000009A0000-0x0000000001311000-memory.dmp

Filesize
9.4MB

Download
memory/2284-134-0x00000000009A0000-0x0000000001311000-memory.dmp

Filesize
9.4MB

Download
memory/2284-138-0x00000000009A0000-0x0000000001311000-memory.dmp

Filesize
9.4MB

Download
memory/2480-141-0x0000000000000000-mapping.dmp

Download
memory/2480-142-0x0000000001310000-0x0000000001311000-memory.dmp

Filesize
4KB

Download
memory/4568-135-0x0000000000000000-mapping.dmp

Download
memory/4568-139-0x00000000005C0000-0x0000000000F31000-memory.dmp

Filesize
9.4MB

Download
memory/4568-143-0x00000000005C0000-0x0000000000F31000-memory.dmp

Filesize
9.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads