warzonerat | 2f9fdfac896e4f6367f1b06a9a2e572be081b09603bcfeae8355afc3c6d43146

Analysis

max time kernel
142s
max time network
148s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
21-03-2023 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe
Size

176KB
MD5

f2e4e0ba9fc3fe9d2229c31c4a5a40d0
SHA1

835ddaa41c2111632f4564f200dbceb969851f1e
SHA256

84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780
SHA512

39abfa17838eb52e393041a8f2f1f8e47a88a26fb644ceeb4322d93d3fe82ab016a023b42569a3d58e079f837b606877a42c05e0855f7b2936fe3ab4d28612a5
SSDEEP

3072:WfY/TU9fE9PEtuRbrDbPTMuOqCw5NQhDd3+4/qxvVHY0MLtTtQS0W1KHdqML:AYa6XrDbP6vw5ipvgvVHY0UTSJ9l

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

omerlan.duckdns.org:6548

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1628-70-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/1628-74-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/1628-75-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

Processes:

pcspikx.exepcspikx.exe

pid process

1684 pcspikx.exe
1628 pcspikx.exe

pid	process
1684	pcspikx.exe
1628	pcspikx.exe

Loads dropped DLL 3 IoCs

Processes:

84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exepcspikx.exe

pid	process
1952	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe
1952	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe
1684	pcspikx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pcspikx.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3948302646-268491222-1934009652-1000\Software\Microsoft\Windows\CurrentVersion\Run\sowsclhqavf = "C:\\Users\\Admin\\AppData\\Roaming\\vfokscxhdmvrb\\kgplueaj.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\pcspikx.exe\" C:\\Users\\Admin\\AppData\\L"	pcspikx.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

pcspikx.exe

description pid process target process

PID 1684 set thread context of 1628 1684 pcspikx.exe pcspikx.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

pcspikx.exe

pid process

1684 pcspikx.exe

description	pid	process	target process
PID 1684 set thread context of 1628	1684	pcspikx.exe	pcspikx.exe

pid	process
1684	pcspikx.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exepcspikx.exe

description	pid	process	target process
PID 1952 wrote to memory of 1684	1952	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe	pcspikx.exe
PID 1952 wrote to memory of 1684	1952	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe	pcspikx.exe
PID 1952 wrote to memory of 1684	1952	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe	pcspikx.exe
PID 1952 wrote to memory of 1684	1952	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe	pcspikx.exe
PID 1684 wrote to memory of 1628	1684	pcspikx.exe	pcspikx.exe
PID 1684 wrote to memory of 1628	1684	pcspikx.exe	pcspikx.exe
PID 1684 wrote to memory of 1628	1684	pcspikx.exe	pcspikx.exe
PID 1684 wrote to memory of 1628	1684	pcspikx.exe	pcspikx.exe
PID 1684 wrote to memory of 1628	1684	pcspikx.exe	pcspikx.exe

C:\Users\Admin\AppData\Local\Temp\84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe
"C:\Users\Admin\AppData\Local\Temp\84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1952

C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
"C:\Users\Admin\AppData\Local\Temp\pcspikx.exe" C:\Users\Admin\AppData\Local\Temp\oiusxmgnt.njd
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1684

C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
"C:\Users\Admin\AppData\Local\Temp\pcspikx.exe"
3⤵
- Executes dropped EXE
PID:1628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oiusxmgnt.njd
Filesize
8KB

MD5
26278b38925678153585aac1eec3e0aa

SHA1
7a302d829d850afaefd2ad89b647450f590dcef6

SHA256
d1595b7e593d44cb831badbafceceeec19e51917b7388d7ffeac2e5ea40f9745

SHA512
20d198ab0d39689d27020cbfea6be0ad892c5dee5011a27a161fd107131a30501d8134f39e6657cb77068c604ef213fa2fbd313a236f9af8a35f6e60c53cfb4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\rylhmvfqh.s
Filesize
118KB

MD5
a7504e8404f8dad99b77d99cf5adf7b8

SHA1
bb8cf3ccaed5dc577eff22bbc1131183ab0af1fe

SHA256
704fcac5f6867f62af282555fd8186c822107fbdbc40db2d60f4f808e8aa55d9

SHA512
0cc001ee2f1d70c61403896a2f50510212079abe5be7378af6eb603e3cc51c5ece265a0587641a5741c3aa66071e72dc1cd2b0ab64c91e67aba10db45f23c53a

Download Submit
\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
memory/1628-70-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1628-74-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1628-75-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download