warzonerat | b9c205ac1dc948cb5cfa1976b97d531df0b99d8e5d58be4eabbefdf8005984b3

Analysis

max time kernel
129s
max time network
78s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
09/01/2023, 03:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GreatJob.exe
Size 1.1MB
Sample230109-d8rtrsch44
SHA256 b9c205ac1dc948cb5cfa1976b97d531df0b99d8e5d58be4eabbefdf8005984b3
MD5 49ee7c9b60ca4477b46b9377e1eb6fa7
SHA1 d3ed64f6e2dee82b559eed4d2a45f14946e9eaa8
SHA512 c6c502a068e1a1c2fd170b41fc99e40284fd81eb3110e91ad02ebe75cde22b10815c6ac2019bafff7a991e92a9fac4647816790a2bdcc7c8a9246433f53e9b9a
SSDEEP 24576:H0rVJRR1i3e2acyq6nc/Xwio+bYYKXtjPKpksJokdppfGwCmy:H0rVJRR1xLq6UXwiM5XtjPiJvpuwhy
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 2 IoCs

pid	Process
328	greenw.exe
1748	msgt.exe

Loads dropped DLL 2 IoCs

pid	Process
328	greenw.exe
328	greenw.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\GreenWar = "C:\\Users\\Admin\\Documents\\msgt.exe"	greenw.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
960	powershell.exe
1692	GreatJob.exe
1692	GreatJob.exe
772	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	960	powershell.exe
Token: SeDebugPrivilege	1692	GreatJob.exe
Token: SeDebugPrivilege	772	powershell.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 960	1692	GreatJob.exe	27
PID 1692 wrote to memory of 960	1692	GreatJob.exe	27
PID 1692 wrote to memory of 960	1692	GreatJob.exe	27
PID 1692 wrote to memory of 328	1692	GreatJob.exe	29
PID 1692 wrote to memory of 328	1692	GreatJob.exe	29
PID 1692 wrote to memory of 328	1692	GreatJob.exe	29
PID 1692 wrote to memory of 328	1692	GreatJob.exe	29
PID 328 wrote to memory of 772	328	greenw.exe	31
PID 328 wrote to memory of 772	328	greenw.exe	31
PID 328 wrote to memory of 772	328	greenw.exe	31
PID 328 wrote to memory of 772	328	greenw.exe	31
PID 328 wrote to memory of 1748	328	greenw.exe	33
PID 328 wrote to memory of 1748	328	greenw.exe	33
PID 328 wrote to memory of 1748	328	greenw.exe	33
PID 328 wrote to memory of 1748	328	greenw.exe	33

C:\Users\Admin\AppData\Local\Temp\GreatJob.exe
"C:\Users\Admin\AppData\Local\Temp\GreatJob.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:960
- C:\Users\Admin\AppData\Local\Temp\greenw.exe
  "C:\Users\Admin\AppData\Local\Temp\greenw.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:328
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:772
- - C:\Users\Admin\Documents\msgt.exe
    "C:\Users\Admin\Documents\msgt.exe"
    3⤵
    - Executes dropped EXE
    PID:1748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

greenw.exe

Path C:\Users\Admin\AppData\Local\Temp\greenw.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

greenw.exe

Path C:\Users\Admin\AppData\Local\Temp\greenw.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgt.exe

Path C:\Users\Admin\Documents\msgt.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgt.exe

Path \Users\Admin\Documents\msgt.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

msgt.exe

Path \Users\Admin\Documents\msgt.exe
Size 141KB
SHA256 21d7fa3dd28eb5d3eb3facd4673eb75021ae4853fbdd5e9c95cf0ceef193f27b
MD5 75ff251476dfccb1ce39a78d4ab00b4b
SHA1 18c27b54bee0b41d290215812d59613ef928e41d
SHA512 f3e418164067324a6bceadc44a4d762c412000cef7b44d471edaa09c95f61305f19458b2d2db8b82857f4703379e86f5c900179db7a5d5325203e70d361cbcd0
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/328-71-0x0000000075661000-0x0000000075663000-memory.dmp

Download

memory/772-76-0x00000000732F0000-0x000000007389B000-memory.dmp

Download

memory/772-75-0x00000000732F0000-0x000000007389B000-memory.dmp

Download

memory/960-62-0x0000000002294000-0x0000000002297000-memory.dmp

Download

memory/960-61-0x000007FEEA700000-0x000007FEEB25D000-memory.dmp

Download

memory/960-60-0x000007FEEB260000-0x000007FEEBC83000-memory.dmp

Download

memory/960-65-0x000000000229B000-0x00000000022BA000-memory.dmp

Download

memory/960-64-0x0000000002294000-0x0000000002297000-memory.dmp

Download

memory/960-63-0x000000000229B000-0x00000000022BA000-memory.dmp

Download

memory/1692-66-0x000000001F6F0000-0x000000001F76C000-memory.dmp

Download

memory/1692-54-0x00000000009E0000-0x0000000000AF4000-memory.dmp

Download

memory/1692-68-0x000000001BFE6000-0x000000001C005000-memory.dmp

Download

memory/1692-67-0x000000001F3B0000-0x000000001F42F000-memory.dmp

Download

memory/1692-57-0x0000000002320000-0x00000000023B2000-memory.dmp

Download

memory/1692-56-0x000000001B660000-0x000000001B76E000-memory.dmp

Download

memory/1692-55-0x000007FEFBB31000-0x000007FEFBB33000-memory.dmp

Download