warzonerat | 5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e

General

Target

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
Size

703KB
MD5

b3d80e279422e9a2fccc6eb9b199502c
SHA1

d080ae1c3fca9ac92fc51a8b38521c68dcbfa769
SHA256

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e
SHA512

10e4e2a7fd3824abe301650822aa183f7ffc6c415338f9fe36fe219f155b5fe3a1900b4cf5d2fe1a207ebf392488c7ac699ff0fd1cd6a21b79a90741d1ec610e
SSDEEP

12288:1YV6MorX7qzuC3QHO9FQVHPF51jgclbrqkLOdb4A9GAq3kF3h4i7alIV:qBXu9HGaVHFqky94J/32CU

Score

10^/10

warzonerat infostealer rat upx

Malware Config

Extracted

Family

warzonerat

C2

193.56.28.104:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1976-58-0x00000000000D0000-0x00000000000ED000-memory.dmp	warzonerat
behavioral1/memory/1976-66-0x00000000000D57A3-mapping.dmp	warzonerat
behavioral1/memory/1976-68-0x00000000000D0000-0x00000000000ED000-memory.dmp	warzonerat

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2008-55-0x00000000001B0000-0x000000000033B000-memory.dmp	upx
behavioral1/memory/2008-69-0x00000000001B0000-0x000000000033B000-memory.dmp	upx
behavioral1/memory/1976-70-0x00000000001B0000-0x000000000033B000-memory.dmp	upx

Drops startup file 1 IoCs

Processes:

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MpSigStub.url	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

Processes:

resource	yara_rule
behavioral1/memory/2008-69-0x00000000001B0000-0x000000000033B000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

description	pid	process	target process
PID 2008 set thread context of 1976	2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

pid	process
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

Suspicious use of FindShellTrayWindow 3 IoCs

Processes:

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

pid	process
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

Suspicious use of SendNotifyMessage 3 IoCs

Processes:

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

pid	process
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

description	pid	process	target process
PID 2008 wrote to memory of 1976	2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
PID 2008 wrote to memory of 1976	2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
PID 2008 wrote to memory of 1976	2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
PID 2008 wrote to memory of 1976	2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
PID 2008 wrote to memory of 1976	2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
PID 2008 wrote to memory of 1976	2008	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe	5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe

C:\Users\Admin\AppData\Local\Temp\5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
"C:\Users\Admin\AppData\Local\Temp\5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe
"C:\Users\Admin\AppData\Local\Temp\5dbd48a7885c2d7b51e66818fb5ca4a6816216c87cd8ed50719476b33d11a40e.exe"
2⤵
PID:1976

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1976-56-0x00000000000D0000-0x00000000000ED000-memory.dmp

Filesize
116KB

Download
memory/1976-58-0x00000000000D0000-0x00000000000ED000-memory.dmp

Filesize
116KB

Download
memory/1976-66-0x00000000000D57A3-mapping.dmp

Download
memory/1976-68-0x00000000000D0000-0x00000000000ED000-memory.dmp

Filesize
116KB

Download
memory/1976-70-0x00000000001B0000-0x000000000033B000-memory.dmp

Filesize
1.5MB

Download
memory/2008-54-0x00000000760D1000-0x00000000760D3000-memory.dmp

Filesize
8KB

Download
memory/2008-55-0x00000000001B0000-0x000000000033B000-memory.dmp

Filesize
1.5MB

Download
memory/2008-69-0x00000000001B0000-0x000000000033B000-memory.dmp

Filesize
1.5MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads