warzonerat | 6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e

General

Target

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
Size

2.2MB
MD5

f675e9e7887a04ae492160e25cbea933
SHA1

cba8bc539dc121dd943dba6d25482f340cfd607a
SHA256

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e
SHA512

a12ebbe3194726ff79b97970ab7c5dd8e742072b47e277b93c348174e2e4da5c551e637a23959c81c1e1e178c738f3273b2dbf538af1b76e0989e7360c5effea
SSDEEP

49152:anjW5Q6ipFhxlNpx0rmwxhf3OQZHeVGK4uGVD94:yd6iHsmwT39ZHeVGK48

Score

10^/10

warzonerat evasion infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

jackbaur75.linkpc.net:3230

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

Warzone RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/4124-137-0x0000000000400000-0x0000000000419000-memory.dmp	warzonerat
behavioral2/memory/4124-139-0x0000000000400000-0x0000000000419000-memory.dmp	warzonerat
behavioral2/memory/4124-145-0x0000000000400000-0x0000000000419000-memory.dmp	warzonerat
behavioral2/memory/4124-147-0x0000000000400000-0x0000000000419000-memory.dmp	warzonerat

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

Processes:

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Wine	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

description	pid	process	target process
PID 3416 set thread context of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 set thread context of 1580	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	diskperf.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe

C:\Users\Admin\AppData\Local\Temp\6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
"C:\Users\Admin\AppData\Local\Temp\6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3416

C:\Users\Admin\AppData\Local\Temp\6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
"C:\Users\Admin\AppData\Local\Temp\6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe"
2⤵
PID:4124

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
2⤵
PID:1580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2

T1497

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

3

T1012

Virtualization/Sandbox Evasion

2

T1497

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1580-140-0x0000000000000000-mapping.dmp

Download
memory/1580-146-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1580-143-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1580-142-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/1580-141-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/3416-135-0x0000000000400000-0x000000000094D000-memory.dmp

Filesize
5.3MB

Download
memory/3416-132-0x0000000000400000-0x000000000094D000-memory.dmp

Filesize
5.3MB

Download
memory/3416-134-0x0000000000400000-0x000000000094D000-memory.dmp

Filesize
5.3MB

Download
memory/3416-144-0x0000000000400000-0x000000000094D000-memory.dmp

Filesize
5.3MB

Download
memory/3416-133-0x0000000000400000-0x000000000094D000-memory.dmp

Filesize
5.3MB

Download
memory/4124-139-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4124-137-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4124-136-0x0000000000000000-mapping.dmp

Download
memory/4124-145-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/4124-147-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

description	pid	process	target process
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 4124	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe
PID 3416 wrote to memory of 1580	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	diskperf.exe
PID 3416 wrote to memory of 1580	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	diskperf.exe
PID 3416 wrote to memory of 1580	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	diskperf.exe
PID 3416 wrote to memory of 1580	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	diskperf.exe
PID 3416 wrote to memory of 1580	3416	6f888bfb577e35b282e35a1763429c21bf94651cd180e6ff26079a3ef25e712e.exe	diskperf.exe

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads