warzonerat | d0d03da3e2d11c18da8588b4061ea885005160f3bfb0f30f62aa582285ed2e9f

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
12/01/2023, 11:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe
Size 1.2MB
Sample230112-n316csfh33
SHA256 d0d03da3e2d11c18da8588b4061ea885005160f3bfb0f30f62aa582285ed2e9f
MD5 d4d43f1f73e748a8f62c065608da8df6
SHA1 f5af7990627e9c3d55325ef55b0711e21ff1459b
SHA512 8e18d5c553d1acf821b7c61eb584b57ed4169b37fde8fe2554358f7d53103d7fdff7f1de250700caa07bc070ef8d6fa3610bbd819a06c0c3607a4f1fcfc34ab9
SSDEEP 24576:C/CFiGPNiwy7vYIIMmUgxrI1RqxzRSAoqe3b3Nu5geX3tYm+HmBb+vnIErY:C/CMUhI1RqxoAle3b3N8geX3OdHmBCvS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,\"C:\\Users\\Admin\\AppData\\Local\\Chromesoft.exe\","	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Executes dropped EXE 2 IoCs

pid	Process
3600	first.exe
2892	images.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Control Panel\International\Geo\Nation	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\Documents\\images.exe"	first.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
4724	powershell.exe
4724	powershell.exe
1632	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe
2064	powershell.exe
2064	powershell.exe
3988	powershell.exe
3988	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	powershell.exe
Token: SeDebugPrivilege	1632	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe
Token: SeDebugPrivilege	2064	powershell.exe
Token: SeDebugPrivilege	3988	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 4724	1632	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe	81
PID 1632 wrote to memory of 4724	1632	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe	81
PID 1632 wrote to memory of 3600	1632	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe	89
PID 1632 wrote to memory of 3600	1632	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe	89
PID 1632 wrote to memory of 3600	1632	SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe	89
PID 3600 wrote to memory of 2064	3600	first.exe	90
PID 3600 wrote to memory of 2064	3600	first.exe	90
PID 3600 wrote to memory of 2064	3600	first.exe	90
PID 3600 wrote to memory of 2892	3600	first.exe	93
PID 3600 wrote to memory of 2892	3600	first.exe	93
PID 3600 wrote to memory of 2892	3600	first.exe	93
PID 2892 wrote to memory of 3988	2892	images.exe	94
PID 2892 wrote to memory of 3988	2892	images.exe	94
PID 2892 wrote to memory of 3988	2892	images.exe	94
PID 2892 wrote to memory of 1804	2892	images.exe	96
PID 2892 wrote to memory of 1804	2892	images.exe	96
PID 2892 wrote to memory of 1804	2892	images.exe	96
PID 2892 wrote to memory of 1804	2892	images.exe	96
PID 2892 wrote to memory of 1804	2892	images.exe	96

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Generic.ML.PUA.30856.30968.exe"
1⤵
- Modifies WinLogon for persistence
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4724
- C:\Users\Admin\AppData\Local\Temp\first.exe
  "C:\Users\Admin\AppData\Local\Temp\first.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:3600
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2064
- - C:\Users\Admin\Documents\images.exe
    "C:\Users\Admin\Documents\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:2892
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell Add-MpPreference -ExclusionPath C:\
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3988
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:1804

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Size 2KB
SHA256 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
MD5 968cb9309758126772781b83adb8a28f
SHA1 8da30e71accf186b2ba11da1797cf67f8f78b47c
SHA512 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 218d487f881ce9640acd16f7476b445471b83671569e99973f77d0bbf6c42ffa
MD5 3db5a3b556b01c59c5812cb86abb674e
SHA1 3848e5419d5c47879f159247e4f1b08005674cf0
SHA512 3eb6575d3e476053a65b2631b0cd0d584056ca476058ee2706c69fe10b0502460c40f8985f1f4666e42fba2809924f6dc34ba2e9b2629217542e45cb3640adcd
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 304B
SHA256 46e828a4fb09603701635493778905db21bdf9e8706fc23b4850e4dd8c9f7cf3
MD5 41317f1d96dc3c0f29e4ab3f074b778c
SHA1 abb719843e33fdb13bd1fbfc209ee6e2f8f4c0d4
SHA512 cb0cddc39f64164f4d126916c31eb93d1099a01a8b2074288825e5c30d534a90e9df11ad00df97ff15a1d08056c96ae9a36a543d445451bc0a6fb7515c1970c0
MD5 SHA1 SHA512

Submit Download

first.exe

Path C:\Users\Admin\AppData\Local\Temp\first.exe
Size 141KB
SHA256 2ec2fa01b59783d8164eda64e6268889345a21f075b302ec40bd5f181a93b178
MD5 ce3f9446004616a9c4a016d91c0f4181
SHA1 14bf68e9509b062bfbf0317041f3b2ff8b981d0b
SHA512 e0fc75b4366c005b2bd377b5980fd1dee555c0263c0bfacd797acadb42cf6654c5218867318ca8d1244dc387bb62c6e5d75180b952732a2e2228f160dbbf0b0e
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

first.exe

Path C:\Users\Admin\AppData\Local\Temp\first.exe
Size 141KB
SHA256 2ec2fa01b59783d8164eda64e6268889345a21f075b302ec40bd5f181a93b178
MD5 ce3f9446004616a9c4a016d91c0f4181
SHA1 14bf68e9509b062bfbf0317041f3b2ff8b981d0b
SHA512 e0fc75b4366c005b2bd377b5980fd1dee555c0263c0bfacd797acadb42cf6654c5218867318ca8d1244dc387bb62c6e5d75180b952732a2e2228f160dbbf0b0e
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

images.exe

Path C:\Users\Admin\Documents\images.exe
Size 141KB
SHA256 2ec2fa01b59783d8164eda64e6268889345a21f075b302ec40bd5f181a93b178
MD5 ce3f9446004616a9c4a016d91c0f4181
SHA1 14bf68e9509b062bfbf0317041f3b2ff8b981d0b
SHA512 e0fc75b4366c005b2bd377b5980fd1dee555c0263c0bfacd797acadb42cf6654c5218867318ca8d1244dc387bb62c6e5d75180b952732a2e2228f160dbbf0b0e
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

images.exe

Path C:\Users\Admin\Documents\images.exe
Size 141KB
SHA256 2ec2fa01b59783d8164eda64e6268889345a21f075b302ec40bd5f181a93b178
MD5 ce3f9446004616a9c4a016d91c0f4181
SHA1 14bf68e9509b062bfbf0317041f3b2ff8b981d0b
SHA512 e0fc75b4366c005b2bd377b5980fd1dee555c0263c0bfacd797acadb42cf6654c5218867318ca8d1244dc387bb62c6e5d75180b952732a2e2228f160dbbf0b0e
SSDEEP 3072:RARHROub6IiZktM+t4B6IZeAzaZyJ6QYzHHxgGT0Iw:RkxbQktMo4BRiyjYz6GTrw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1632-137-0x00007FFE097D0000-0x00007FFE0A291000-memory.dmp

Download

memory/1632-169-0x0000022CA52C9000-0x0000022CA52CF000-memory.dmp

Download

memory/1632-140-0x0000022CA68E0000-0x0000022CA694D000-memory.dmp

Download

memory/1632-141-0x0000022CA52C9000-0x0000022CA52CF000-memory.dmp

Download

memory/1632-134-0x0000022CA71B0000-0x0000022CA71D2000-memory.dmp

Download

memory/1632-133-0x00007FFE097D0000-0x00007FFE0A291000-memory.dmp

Download

memory/1632-132-0x0000022C89B00000-0x0000022C89C3A000-memory.dmp

Download

memory/1804-172-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/2064-162-0x0000000007940000-0x00000000079D6000-memory.dmp

Download

memory/2064-161-0x0000000007730000-0x000000000773A000-memory.dmp

Download

memory/2064-150-0x0000000005D90000-0x0000000005DF6000-memory.dmp

Download

memory/2064-148-0x0000000005410000-0x0000000005432000-memory.dmp

Download

memory/2064-152-0x00000000063B0000-0x00000000063CE000-memory.dmp

Download

memory/2064-166-0x00000000079E0000-0x00000000079E8000-memory.dmp

Download

memory/2064-147-0x00000000056F0000-0x0000000005D18000-memory.dmp

Download

memory/2064-146-0x0000000002A80000-0x0000000002AB6000-memory.dmp

Download

memory/2064-156-0x0000000007370000-0x00000000073A2000-memory.dmp

Download

memory/2064-157-0x0000000070160000-0x00000000701AC000-memory.dmp

Download

memory/2064-158-0x0000000006970000-0x000000000698E000-memory.dmp

Download

memory/2064-159-0x0000000007D10000-0x000000000838A000-memory.dmp

Download

memory/2064-160-0x00000000076C0000-0x00000000076DA000-memory.dmp

Download

memory/2064-149-0x0000000005D20000-0x0000000005D86000-memory.dmp

Download

memory/2064-165-0x0000000007A00000-0x0000000007A1A000-memory.dmp

Download

memory/2064-164-0x00000000078F0000-0x00000000078FE000-memory.dmp

Download

memory/3988-167-0x0000000070160000-0x00000000701AC000-memory.dmp

Download

memory/4724-139-0x00007FFE097D0000-0x00007FFE0A291000-memory.dmp

Download

memory/4724-138-0x00007FFE097D0000-0x00007FFE0A291000-memory.dmp

Download

memory/4724-136-0x00007FFE097D0000-0x00007FFE0A291000-memory.dmp

Download