warzonerat | 918bd8df4133a9c6a279757baf27e33ce33c0d115e405178c4563a556e26b647

Analysis

max time kernel
96s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2023, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
50695a48edcc2576675a4d862311b28b.exe
Size 222KB
Sample230224-lnzymsag93
SHA256 918bd8df4133a9c6a279757baf27e33ce33c0d115e405178c4563a556e26b647
MD5 50695a48edcc2576675a4d862311b28b
SHA1 1e390ccab122caa7f1c396ed0325cdc572a65946
SHA512 6b927a88973641ceaab1ae01bd80414d540f14d408435f9aee1a387e5f190d42272a9c6e6a873573547a45df3f7b041cbbc148360e528fbe948e52578009d789
SSDEEP 3072:/fY/TU9fE9PEtuZsbZUeHbkZUHZ+rINhqX+E13rGowgdMoTnqFiDyJvS+sr3vPPH:XYa6HOZUtFwlMrxwgUYGts7PwhtxY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll"	giuiwxga.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Control Panel\International\Geo\Nation	giuiwxga.exe

Executes dropped EXE 2 IoCs

pid	Process
3656	giuiwxga.exe
4404	giuiwxga.exe

Loads dropped DLL 1 IoCs

pid	Process
1816	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ktoxhdmv = "C:\\Users\\Admin\\AppData\\Roaming\\vrbkgpxtd\\yrrnwgclhqavfo.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\giuiwxga.exe\" C:\\Users\\Admin\\AppDat"	giuiwxga.exe

Modifies WinLogon 2 TTPs 4 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList	giuiwxga.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts	giuiwxga.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\bbc.pdu = "0"	giuiwxga.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1"	giuiwxga.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\rfxvmt.dll	giuiwxga.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3656 set thread context of 4404	3656	giuiwxga.exe	88

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft DN1\sqlmap.dll	giuiwxga.exe
File created	C:\Program Files\Microsoft DN1\rdpwrap.ini	giuiwxga.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1816	svchost.exe
1816	svchost.exe
1816	svchost.exe
1816	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
672	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3656	giuiwxga.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4404	giuiwxga.exe
Token: SeAuditPrivilege	1816	svchost.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 3656	2640	50695a48edcc2576675a4d862311b28b.exe	86
PID 2640 wrote to memory of 3656	2640	50695a48edcc2576675a4d862311b28b.exe	86
PID 2640 wrote to memory of 3656	2640	50695a48edcc2576675a4d862311b28b.exe	86
PID 3656 wrote to memory of 4404	3656	giuiwxga.exe	88
PID 3656 wrote to memory of 4404	3656	giuiwxga.exe	88
PID 3656 wrote to memory of 4404	3656	giuiwxga.exe	88
PID 3656 wrote to memory of 4404	3656	giuiwxga.exe	88

C:\Users\Admin\AppData\Local\Temp\50695a48edcc2576675a4d862311b28b.exe
"C:\Users\Admin\AppData\Local\Temp\50695a48edcc2576675a4d862311b28b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe
  "C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe" C:\Users\Admin\AppData\Local\Temp\xmfqciidksw.w
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:3656
- - C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe
    "C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe"
    3⤵
    - Sets DLL path for service in the registry
    - Checks computer location settings
    - Executes dropped EXE
    - Modifies WinLogon
    - Drops file in System32 directory
    - Drops file in Program Files directory
    - Suspicious use of AdjustPrivilegeToken
    PID:4404

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
PID:640

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -s TermService
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sqlmap.dll

Path C:\Program Files\Microsoft DN1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

giuiwxga.exe

Path C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe
Size 60KB
SHA256 85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e
MD5 7e14ab7fdec2ba5ca24b6a3af21c430b
SHA1 8621b145ec2936a18a57ec5296c7b3ed088ba692
SHA512 3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06
SSDEEP 768:nTJqhyxLuuFWtb5S0+f6LbMQbe0jyA3tGsq/RbYOtE9FCXs1WMmcG9KRCuPNK8Wz:ntwNto0+4MQbXjdG9/YCyGKJ7em1Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

giuiwxga.exe

Path C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe
Size 60KB
SHA256 85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e
MD5 7e14ab7fdec2ba5ca24b6a3af21c430b
SHA1 8621b145ec2936a18a57ec5296c7b3ed088ba692
SHA512 3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06
SSDEEP 768:nTJqhyxLuuFWtb5S0+f6LbMQbe0jyA3tGsq/RbYOtE9FCXs1WMmcG9KRCuPNK8Wz:ntwNto0+4MQbXjdG9/YCyGKJ7em1Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

giuiwxga.exe

Path C:\Users\Admin\AppData\Local\Temp\giuiwxga.exe
Size 60KB
SHA256 85c5b0156d4043daaad9128b437c0124895a15678c155c3f3583003e1f16095e
MD5 7e14ab7fdec2ba5ca24b6a3af21c430b
SHA1 8621b145ec2936a18a57ec5296c7b3ed088ba692
SHA512 3b5d524326b84664a9ebe67dcd66ad61c4764dd2940d6ade22c963719c7c697d82c0f2e0784b79fae3fb36322586c325781c3e9fb8a30cf6ddb6e3dbf5f65f06
SSDEEP 768:nTJqhyxLuuFWtb5S0+f6LbMQbe0jyA3tGsq/RbYOtE9FCXs1WMmcG9KRCuPNK8Wz:ntwNto0+4MQbXjdG9/YCyGKJ7em1Q
MD5 SHA1 SHA512 SSDEEP

Submit Download

lfdaorq.t

Path C:\Users\Admin\AppData\Local\Temp\lfdaorq.t
Size 161KB
SHA256 aef63c8e0201a2975249852a6c7a11f256e615020ac04b5c31a5906b2bd30d2a
MD5 6bf7158a9b5dc387e0dd79895abf1e52
SHA1 4dbffcaf9ea9b37d32b173af246532a13f71d1a6
SHA512 3aa3926ca6a8a772f66193a5a590720205f40b13656990935abcad1ac2faff6dad71f15bf1558fbd807d9479ece65da26181dbdc3ee88de59081ccc344c7f1b5
SSDEEP 3072:DYnLFT4lNxl7uNyLsDuqeGhasLzSnsYs59nqRfSFF3hlgzF:MnLEl7uNBuH6asLzSnmIdSFFRep
MD5 SHA1 SHA512 SSDEEP

Submit Download

xmfqciidksw.w

Path C:\Users\Admin\AppData\Local\Temp\xmfqciidksw.w
Size 8KB
SHA256 238df51fccc66a32a3d082766a3642939a4422c6ed658936d2e365dbcc7cb264
MD5 0407fc904cad9de15d803cb22985308a
SHA1 047eb49d90a212bd61ff6fa8b0f813e6899a0f3d
SHA512 3625e85b843f378ea18dc2d5ec66fbbf96784cfc5ceb5a93e90249fab9ec25dd1ba84ff1c7d6329d53fc6e97338f90e59f53c21110f117e424c9b2054dff8055
SSDEEP 192:BarcitQvArWiPqdTDZpgaoYU9SFq7RIxHgn1cOmSBQiF:KCYrNPqdTS9SF4IxHjqZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

rdpwrap.ini

Path \??\c:\program files\microsoft dn1\rdpwrap.ini
Size 299KB
SHA256 1c4930123ec2a809b3bd93969967d6c321d8d65fc7b886e062b2581c741944e5
MD5 fca6ba93c780afa00a5703df9ac65754
SHA1 3ed423763fdd9722ff8bed3667ffa93f77390138
SHA512 538b0995be3796737575a2fd3aaa1644b3e6566e4cd5ed5c4df9e0a586368e7ceea8f0284de53f7c3f0874fc90b9a194d2ea1438bc9d7779eb12d00b8807f595
SSDEEP 768:yUiQVQpXQq4WDi9SUnpB8fbQnxJcy8RMFdKKb5x8Rr/d6gl/+f8jZ0ftlFi4p7QK:fjt33L+McIiG4IvREWddadl/Fj8
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlmap.dll

Path \??\c:\program files\microsoft dn1\sqlmap.dll
Size 114KB
SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
MD5 461ade40b800ae80a40985594e1ac236
SHA1 b3892eef846c044a2b0785d54a432b3e93a968c8
SHA512 421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26
SSDEEP 3072:m3zxbyHM+TstVfFyov7je9LBMMmMJDOvYYVs:oMjTiVw2ve9LBMMpJsT
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3656-140-0x0000000001380000-0x0000000001383000-memory.dmp

Download

memory/4404-148-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4404-149-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4404-151-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4404-147-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4404-143-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4404-161-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4404-162-0x0000000000400000-0x000000000055C000-memory.dmp

Download

memory/4404-163-0x0000000000400000-0x000000000055C000-memory.dmp

Download