warzonerat | bfca651a0de33efa850d4e3e755aa2e5b1057ffa96edee14dbea1e57134aed4f

General

Target

267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe
Size

474KB
MD5

4f675e8096f33c630b63e11ca67753a7
SHA1

8e525226e608dbd84f0c6bddf71f2e5ffb05645f
SHA256

267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f
SHA512

59a6b5a2db27ac3876dcb629eb1e854dfbd99ae87c90c6f6eb0fe5dbb78eaa312909b58e482a9462b2fc9dd12083bd46c7e90b806b3f7e779a8d01264b59e810
SSDEEP

12288:RWcWnFt4sHQA793uk0FaKwR4KrjQD60+ayvsHC6rRl6Fklbddxppppppppppppp5:8rYD+wkfjQDHy6rFd

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

103.231.91.59:17873

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1320-71-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/1320-72-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/1320-73-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/1320-75-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/1320-77-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/1320-79-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1283023626-844874658-3193756055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Gzqtg = "\"C:\\Users\\Admin\\AppData\\Roaming\\Awsmttwuimd\\Gzqtg.exe\""	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe

description	pid	process	target process
PID 2024 set thread context of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe

pid process

1744 powershell.exe
2024 267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe

pid	process
1744	powershell.exe
2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe
Token: SeDebugPrivilege	1744	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

Processes:

267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe

description	pid	process	target process
PID 2024 wrote to memory of 1744	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	powershell.exe
PID 2024 wrote to memory of 1744	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	powershell.exe
PID 2024 wrote to memory of 1744	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	powershell.exe
PID 2024 wrote to memory of 1744	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	powershell.exe
PID 2024 wrote to memory of 1552	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1552	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1552	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1552	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1552	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1552	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1552	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe
PID 2024 wrote to memory of 1320	2024	267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe	RegAsm.exe

C:\Users\Admin\AppData\Local\Temp\267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe
"C:\Users\Admin\AppData\Local\Temp\267e7f40468aa20e4c4741a562d1fd090cdb14be29cff3d3dc6f9c951cf1922f.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2024

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:1552

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
2⤵
PID:1320

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1320-68-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-79-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-77-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-75-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-74-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1320-73-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-72-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-71-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-70-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1320-69-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/1744-61-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/1744-66-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/1744-64-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/1744-65-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/1744-62-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/1744-60-0x0000000002580000-0x00000000025C0000-memory.dmp

Filesize
256KB

Download
memory/2024-63-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download
memory/2024-54-0x0000000001030000-0x00000000010AC000-memory.dmp

Filesize
496KB

Download
memory/2024-57-0x0000000005B50000-0x0000000005BE2000-memory.dmp

Filesize
584KB

Download
memory/2024-56-0x0000000006790000-0x00000000068F0000-memory.dmp

Filesize
1.4MB

Download
memory/2024-55-0x0000000000400000-0x0000000000440000-memory.dmp

Filesize
256KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads