warzonerat | d094cf97104aeb8329fe0d30aaac1defe237c4f05fd57bf5f06c141818143ad4

Analysis

max time kernel
76s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2023, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
96c82b3b09009b6705a261a639310b30.exe
Size 226KB
Sample230227-ty883aee85
SHA256 d094cf97104aeb8329fe0d30aaac1defe237c4f05fd57bf5f06c141818143ad4
MD5 96c82b3b09009b6705a261a639310b30
SHA1 d4f103a21e1424a48813bc9aefc3b1fe59ed4c60
SHA512 110a1ea51ed7a1eff4d54b92f9aec3970e82c3d980a46ac0e7d7bc9b1211bf71fe4b347824573ff8f4765f6a0eb3a8f93808b8f32fbeda4305b51a264251aef4
SSDEEP 3072:WfY/TU9fE9PEtuNbDNNG1mTfInt+S3vJXjqIYA9jwdUGZZFYzgIytf9wXfXsXCQP:AYa6j5NGUAndfljgAKPIytf96PEgsX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

blackroots7.duckdns.org:1104

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1288-143-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/1288-146-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/1288-148-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/1288-149-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
220	pgsbyzauq.exe
1288	pgsbyzauq.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\avff = "C:\\Users\\Admin\\AppData\\Roaming\\pyttdmiirn\\nwggcluuqa.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\pgsbyzauq.exe\" C:\\Users\\Admin\\AppData\\"	pgsbyzauq.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 220 set thread context of 1288	220	pgsbyzauq.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
220	pgsbyzauq.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1288	pgsbyzauq.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 220	4868	96c82b3b09009b6705a261a639310b30.exe	85
PID 4868 wrote to memory of 220	4868	96c82b3b09009b6705a261a639310b30.exe	85
PID 4868 wrote to memory of 220	4868	96c82b3b09009b6705a261a639310b30.exe	85
PID 220 wrote to memory of 1288	220	pgsbyzauq.exe	86
PID 220 wrote to memory of 1288	220	pgsbyzauq.exe	86
PID 220 wrote to memory of 1288	220	pgsbyzauq.exe	86
PID 220 wrote to memory of 1288	220	pgsbyzauq.exe	86

C:\Users\Admin\AppData\Local\Temp\96c82b3b09009b6705a261a639310b30.exe
"C:\Users\Admin\AppData\Local\Temp\96c82b3b09009b6705a261a639310b30.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\pgsbyzauq.exe
  "C:\Users\Admin\AppData\Local\Temp\pgsbyzauq.exe" C:\Users\Admin\AppData\Local\Temp\uygfhzdh.u
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:220
- - C:\Users\Admin\AppData\Local\Temp\pgsbyzauq.exe
    "C:\Users\Admin\AppData\Local\Temp\pgsbyzauq.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1288

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mcwmrb.qs

Path C:\Users\Admin\AppData\Local\Temp\mcwmrb.qs
Size 118KB
SHA256 d69397c3a779fed834fc04f981237606c028050dccd02a2e7eabc1ba3ab4594c
MD5 af81145f01d9bac59852977eab8cdacc
SHA1 382793f11abb6d48eaf54565fb14f0547980c5c2
SHA512 42f40947769c18c9bfac2f3a4210f44bb915b9c9efd44b26e9c5bef2749305e3da074681d28b12b6f5999bd964cfa5a66fe15e1e6606b3208316115c0e488273
SSDEEP 3072:npXQmTHk8W4AcNDz2VneE3qhEwYDMsHNYHFZ3ilNStr78r:npgiE8jVknp3UENDjHU3gNUHg
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgsbyzauq.exe

Path C:\Users\Admin\AppData\Local\Temp\pgsbyzauq.exe
Size 118KB
SHA256 e2e1eb18dee28e22e184b150dacf04e29f1a14d9bb897d8ca2620e50e8287a2e
MD5 1b84284400c67fb5d32b631f92d85fcf
SHA1 f6c0595a577db88abdc4ccad900847e9ce0304ac
SHA512 3d8fb312764cee6225eaca5a806db6223d4e8c3068b903eef23490f50608e3610ac07fb13306977f4c8089bf0258d023255cd5655a4d9478a8acbb1097a8bb82
SSDEEP 1536:rHiCSHIoZ163zXOIH5/RHJax3r3FF29Yq5BxqcVahJ:ri+oZ163Tu3rLq5BxqOy
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgsbyzauq.exe

Path C:\Users\Admin\AppData\Local\Temp\pgsbyzauq.exe
Size 118KB
SHA256 e2e1eb18dee28e22e184b150dacf04e29f1a14d9bb897d8ca2620e50e8287a2e
MD5 1b84284400c67fb5d32b631f92d85fcf
SHA1 f6c0595a577db88abdc4ccad900847e9ce0304ac
SHA512 3d8fb312764cee6225eaca5a806db6223d4e8c3068b903eef23490f50608e3610ac07fb13306977f4c8089bf0258d023255cd5655a4d9478a8acbb1097a8bb82
SSDEEP 1536:rHiCSHIoZ163zXOIH5/RHJax3r3FF29Yq5BxqcVahJ:ri+oZ163Tu3rLq5BxqOy
MD5 SHA1 SHA512 SSDEEP

Submit Download

pgsbyzauq.exe

Path C:\Users\Admin\AppData\Local\Temp\pgsbyzauq.exe
Size 118KB
SHA256 e2e1eb18dee28e22e184b150dacf04e29f1a14d9bb897d8ca2620e50e8287a2e
MD5 1b84284400c67fb5d32b631f92d85fcf
SHA1 f6c0595a577db88abdc4ccad900847e9ce0304ac
SHA512 3d8fb312764cee6225eaca5a806db6223d4e8c3068b903eef23490f50608e3610ac07fb13306977f4c8089bf0258d023255cd5655a4d9478a8acbb1097a8bb82
SSDEEP 1536:rHiCSHIoZ163zXOIH5/RHJax3r3FF29Yq5BxqcVahJ:ri+oZ163Tu3rLq5BxqOy
MD5 SHA1 SHA512 SSDEEP

Submit Download

uygfhzdh.u

Path C:\Users\Admin\AppData\Local\Temp\uygfhzdh.u
Size 7KB
SHA256 bfc4626f71fd6c725870fd1ac3194254eecfa9a9faec10c7c27ee663431c95ad
MD5 1e1333c4c0c4c26cd8e112a4197138bd
SHA1 b9124926b405806a67fc0a33575c2548c48567f5
SHA512 f82df52268f707b0723dbcf3c525356803b03b0637f650ae85d41f8be0c4889990789971e44a9c6a6b59ff0ef96b0cd9b2da1c265e2c2e6fa24f420b059cca74
SSDEEP 192:darcitQvArWiPv0Kb9PE84H0DFa1WLS4Uw1sNI:uCYrNPv0M/4H0DQ1gS4rs+
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1288-143-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1288-146-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1288-148-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/1288-149-0x0000000000400000-0x000000000041D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads