warzonerat | 50757c84690fdfb895f3842fd4ebf08f9372cc225f4ebb23859faa0a6cc946d5

General

Target

84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe
Size

176KB
MD5

f2e4e0ba9fc3fe9d2229c31c4a5a40d0
SHA1

835ddaa41c2111632f4564f200dbceb969851f1e
SHA256

84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780
SHA512

39abfa17838eb52e393041a8f2f1f8e47a88a26fb644ceeb4322d93d3fe82ab016a023b42569a3d58e079f837b606877a42c05e0855f7b2936fe3ab4d28612a5
SSDEEP

3072:WfY/TU9fE9PEtuRbrDbPTMuOqCw5NQhDd3+4/qxvVHY0MLtTtQS0W1KHdqML:AYa6XrDbP6vw5ipvgvVHY0UTSJ9l

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

omerlan.duckdns.org:6548

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/224-143-0x00000000005C0000-0x00000000005DD000-memory.dmp	warzonerat
behavioral2/memory/224-151-0x00000000005C0000-0x00000000005DD000-memory.dmp	warzonerat
behavioral2/memory/224-156-0x00000000005C0000-0x00000000005DD000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

Processes:

pcspikx.exepcspikx.exe

pid process

1112 pcspikx.exe
224 pcspikx.exe

pid	process
1112	pcspikx.exe
224	pcspikx.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

pcspikx.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sowsclhqavf = "C:\\Users\\Admin\\AppData\\Roaming\\vfokscxhdmvrb\\kgplueaj.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\pcspikx.exe\" C:\\Users\\Admin\\AppData\\L"	pcspikx.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

pcspikx.exe

description pid process target process

PID 1112 set thread context of 224 1112 pcspikx.exe pcspikx.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3552 224 WerFault.exe pcspikx.exe
Suspicious behavior: MapViewOfSection 2 IoCs

Processes:

pcspikx.exe

pid process

1112 pcspikx.exe
1112 pcspikx.exe

description	pid	process	target process
PID 1112 set thread context of 224	1112	pcspikx.exe	pcspikx.exe

pid	pid_target	process	target process
3552	224	WerFault.exe	pcspikx.exe

pid	process
1112	pcspikx.exe
1112	pcspikx.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exepcspikx.exe

description	pid	process	target process
PID 1192 wrote to memory of 1112	1192	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe	pcspikx.exe
PID 1192 wrote to memory of 1112	1192	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe	pcspikx.exe
PID 1192 wrote to memory of 1112	1192	84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe	pcspikx.exe
PID 1112 wrote to memory of 224	1112	pcspikx.exe	pcspikx.exe
PID 1112 wrote to memory of 224	1112	pcspikx.exe	pcspikx.exe
PID 1112 wrote to memory of 224	1112	pcspikx.exe	pcspikx.exe
PID 1112 wrote to memory of 224	1112	pcspikx.exe	pcspikx.exe

C:\Users\Admin\AppData\Local\Temp\84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe
"C:\Users\Admin\AppData\Local\Temp\84cc7b5b7b1cd8448cf5529f493a6882016e75c85da54baa30e95fe32452f780.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1192

C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
"C:\Users\Admin\AppData\Local\Temp\pcspikx.exe" C:\Users\Admin\AppData\Local\Temp\oiusxmgnt.njd
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1112

C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
"C:\Users\Admin\AppData\Local\Temp\pcspikx.exe"
3⤵
- Executes dropped EXE
PID:224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 224 -s 496
4⤵
- Program crash
PID:3552

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 224 -ip 224
1⤵
PID:376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\oiusxmgnt.njd
Filesize
8KB

MD5
26278b38925678153585aac1eec3e0aa

SHA1
7a302d829d850afaefd2ad89b647450f590dcef6

SHA256
d1595b7e593d44cb831badbafceceeec19e51917b7388d7ffeac2e5ea40f9745

SHA512
20d198ab0d39689d27020cbfea6be0ad892c5dee5011a27a161fd107131a30501d8134f39e6657cb77068c604ef213fa2fbd313a236f9af8a35f6e60c53cfb4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\pcspikx.exe
Filesize
5KB

MD5
f2ff3f9e75d7598ccf2e5033f27e6cec

SHA1
25180713e0c191de163f0279f0b49c6b4d7b9d31

SHA256
00f6c3c5970760b8f93b56119286d30b483a2ec5c0011c0716d4811398371594

SHA512
5471363503ac2e80da00eac5ced73a9e480209c601d638492c20f9947746d130df87a194526a24f5eef5030fcf46ac3ccaf19d8d2c9dded48cd3028f82c3b23a

Download Submit
C:\Users\Admin\AppData\Local\Temp\rylhmvfqh.s
Filesize
118KB

MD5
a7504e8404f8dad99b77d99cf5adf7b8

SHA1
bb8cf3ccaed5dc577eff22bbc1131183ab0af1fe

SHA256
704fcac5f6867f62af282555fd8186c822107fbdbc40db2d60f4f808e8aa55d9

SHA512
0cc001ee2f1d70c61403896a2f50510212079abe5be7378af6eb603e3cc51c5ece265a0587641a5741c3aa66071e72dc1cd2b0ab64c91e67aba10db45f23c53a

Download Submit
memory/224-143-0x00000000005C0000-0x00000000005DD000-memory.dmp

Filesize
116KB

Download
memory/224-151-0x00000000005C0000-0x00000000005DD000-memory.dmp

Filesize
116KB

Download
memory/224-156-0x00000000005C0000-0x00000000005DD000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads