warzonerat | 66bfee7c40de7f8f6e9d20b337fc22d9eec1a5a1764d3b29c26639ebdeeddc71

General

Target

Kopija prijenosa pla?anjaBohm d.o.o·pdf.exe
Size

703KB
MD5

224276b92f42bd2f29a64adfd7c4377b
SHA1

374a33fd32bc2139c06973ec36ad302ca74f9eac
SHA256

66bfee7c40de7f8f6e9d20b337fc22d9eec1a5a1764d3b29c26639ebdeeddc71
SHA512

f8a9b5819884a9988739a2e93972fcf16f4b615a3020503f47cf2ee9eb1261a42267902fec0ef1418d186ef68df1d3822ec8979e0c43fc51b8ca59392cc680aa
SSDEEP

12288:lPuYd+V6b1momPZefNrInBocHPup1vTfPRgEUQXMXu5qcioLuBomBqQe:lPuYd+V6bIomxiNMecHPupBTHRTUQXMW

Score

10^/10

warzonerat infostealer rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2016-66-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2016-67-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 40 IoCs

Processes:

Kopija prijenosa pla_anjaBohm d.o.o·pdf.exepowershell.exe

pid	process
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
2012	powershell.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

Kopija prijenosa pla_anjaBohm d.o.o·pdf.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1628 Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
Token: SeDebugPrivilege 2012 powershell.exe

description	pid	process
Token: SeDebugPrivilege	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
Token: SeDebugPrivilege	2012	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe

description	pid	process	target process
PID 1628 wrote to memory of 2012	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	powershell.exe
PID 1628 wrote to memory of 2012	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	powershell.exe
PID 1628 wrote to memory of 2012	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	powershell.exe
PID 1628 wrote to memory of 2012	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	powershell.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
PID 1628 wrote to memory of 2016	1628	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe	Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe

C:\Users\Admin\AppData\Local\Temp\Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Users\Admin\AppData\Local\Temp\Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Kopija prijenosa pla_anjaBohm d.o.o·pdf.exe"
2⤵
PID:2016

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1628-60-0x0000000004240000-0x0000000004262000-memory.dmp

Filesize
136KB

Download
memory/1628-54-0x0000000000C50000-0x0000000000D06000-memory.dmp

Filesize
728KB

Download
memory/1628-56-0x0000000000520000-0x000000000053A000-memory.dmp

Filesize
104KB

Download
memory/1628-57-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1628-58-0x0000000004D80000-0x0000000004DDC000-memory.dmp

Filesize
368KB

Download
memory/1628-55-0x0000000075ED1000-0x0000000075ED3000-memory.dmp

Filesize
8KB

Download
memory/2012-59-0x0000000000000000-mapping.dmp

Download
memory/2012-70-0x000000006FBB0000-0x000000007015B000-memory.dmp

Filesize
5.7MB

Download
memory/2012-71-0x000000006FBB0000-0x000000007015B000-memory.dmp

Filesize
5.7MB

Download
memory/2016-61-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2016-66-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2016-64-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2016-62-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2016-67-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads