warzonerat | f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b

General

Target

nht-refund...exe
Size

579KB
MD5

6ca65058e490b038710bd1e2ac8cb457
SHA1

c66ea296401994d1d352b2795b70dd38f7eb4f88
SHA256

f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b
SHA512

f3f473a6e7335b39cdd212ce287070e2f092cc550bd836ca66808b3483ef48c6152ad41a5f9a120c22c268af3960768b6fb7e03a8861bf444052c7cf1476229f
SSDEEP

12288:sctmABdVLhcA9D/4BjCAYEKRkx/yX0chSSuPA:sqdpkBtqoaXLMS+

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

154.16.106.40:4441

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 7 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1768-66-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/1768-67-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/1768-69-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/1768-68-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/1768-71-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/1768-73-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral1/memory/1768-74-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

nht-refund...exe

description pid process target process

PID 1232 set thread context of 1768 1232 nht-refund...exe nht-refund...exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

692 schtasks.exe
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

nht-refund...exe

pid process

1232 nht-refund...exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

nht-refund...exe

description pid process

Token: SeDebugPrivilege 1232 nht-refund...exe

description	pid	process	target process
PID 1232 set thread context of 1768	1232	nht-refund...exe	nht-refund...exe

pid	process
692	schtasks.exe

pid	process
1232	nht-refund...exe

description	pid	process
Token: SeDebugPrivilege	1232	nht-refund...exe

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

nht-refund...exe

description	pid	process	target process
PID 1232 wrote to memory of 692	1232	nht-refund...exe	schtasks.exe
PID 1232 wrote to memory of 692	1232	nht-refund...exe	schtasks.exe
PID 1232 wrote to memory of 692	1232	nht-refund...exe	schtasks.exe
PID 1232 wrote to memory of 692	1232	nht-refund...exe	schtasks.exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe
PID 1232 wrote to memory of 1768	1232	nht-refund...exe	nht-refund...exe

C:\Users\Admin\AppData\Local\Temp\nht-refund...exe
"C:\Users\Admin\AppData\Local\Temp\nht-refund...exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1232

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rsbXbxKsuHPWo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7DC8.tmp"
2⤵
- Creates scheduled task(s)
PID:692

C:\Users\Admin\AppData\Local\Temp\nht-refund...exe
"{path}"
2⤵
PID:1768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1

T1053

Persistence

Scheduled Task

1

T1053

Privilege Escalation

Scheduled Task

1

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp7DC8.tmp
Filesize
1KB

MD5
38487df40ef2d35667f47944d6b2ecdd

SHA1
09e1af43e8331162f1c6ce783563293d0b5c71b1

SHA256
be48ba690fe246238bb9d528889f00781ab6d01e350fe25ebe9b5f1dddf8c594

SHA512
18a8b09a3d26332ced93022cf5733195bc82c75d698ca647f327e149f1ef065f05d6c9c3936cced14ec7dcea3b5d8a0ab2fdecd8bc37286c39235a45dad00592

Download Submit
memory/1232-54-0x0000000001330000-0x00000000013C6000-memory.dmp

Filesize
600KB

Download
memory/1232-55-0x00000000011E0000-0x0000000001220000-memory.dmp

Filesize
256KB

Download
memory/1232-56-0x0000000000240000-0x000000000024C000-memory.dmp

Filesize
48KB

Download
memory/1232-57-0x00000000011E0000-0x0000000001220000-memory.dmp

Filesize
256KB

Download
memory/1232-58-0x0000000000FC0000-0x0000000001038000-memory.dmp

Filesize
480KB

Download
memory/1232-59-0x00000000003E0000-0x0000000000418000-memory.dmp

Filesize
224KB

Download
memory/1768-64-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-63-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-65-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-66-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-67-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-69-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-68-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1768-71-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-73-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download
memory/1768-74-0x0000000000400000-0x0000000000568000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads