warzonerat | 58679b062a4049ab0b5a1ebc39c87bac639ea2d8902243c0739250abaa82c13d

Analysis

max time kernel
96s
max time network
143s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
07-12-2022 07:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Dhl shipment 452869074700.exe
Size

868KB
MD5

e7a39f97d03ec982df461b972e26e932
SHA1

d547036046730d5c0eaa681edd6473c94d43518c
SHA256

58679b062a4049ab0b5a1ebc39c87bac639ea2d8902243c0739250abaa82c13d
SHA512

877d74ad7247e2188423e3ef28c704c7c043728ecb4141544e3fb2dc1ee6dd56b95b61fa0b66df37d7d090edd10b7a127724c317d7072b1a8e89105919c8966e
SSDEEP

12288:roQgKZ/nXt7virmWhlGLaQYImNz+GBlr/NpoplnJjCGry/nFWJGn/nDbee3Opjma:MtpawTnEs/nDV+p

Score

10^/10

warzonerat infostealer rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/808-65-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/808-66-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/808-68-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/808-70-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/808-71-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/808-72-0x000000000040B556-mapping.dmp	warzonerat
behavioral1/memory/808-75-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/808-76-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

Dhl shipment 452869074700.exe

description pid process target process

PID 1092 set thread context of 808 1092 Dhl shipment 452869074700.exe Dhl shipment 452869074700.exe

description	pid	process	target process
PID 1092 set thread context of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

Dhl shipment 452869074700.exe

description	pid	process	target process
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe
PID 1092 wrote to memory of 808	1092	Dhl shipment 452869074700.exe	Dhl shipment 452869074700.exe

C:\Users\Admin\AppData\Local\Temp\Dhl shipment 452869074700.exe
"C:\Users\Admin\AppData\Local\Temp\Dhl shipment 452869074700.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1092

C:\Users\Admin\AppData\Local\Temp\Dhl shipment 452869074700.exe
"C:\Users\Admin\AppData\Local\Temp\Dhl shipment 452869074700.exe"
2⤵
PID:808

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-70-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-68-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-63-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-76-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-65-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-75-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-60-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-66-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-72-0x000000000040B556-mapping.dmp

Download
memory/808-71-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/808-61-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1092-59-0x0000000000A60000-0x0000000000ABC000-memory.dmp

Filesize
368KB

Download
memory/1092-54-0x0000000000D10000-0x0000000000DF0000-memory.dmp

Filesize
896KB

Download
memory/1092-58-0x0000000007E80000-0x0000000007F14000-memory.dmp

Filesize
592KB

Download
memory/1092-56-0x0000000000570000-0x0000000000586000-memory.dmp

Filesize
88KB

Download
memory/1092-55-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/1092-57-0x0000000000580000-0x000000000058E000-memory.dmp

Filesize
56KB

Download