warzonerat | 2ef8026ff0f9d39b9a1c87fcc65d9d2b70ac1ea985fd74a118977d8389f2d471

Analysis

max time kernel
112s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2023, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
Size 579KB
Sample230321-rv5qcsda8t
SHA256 f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b
MD5 6ca65058e490b038710bd1e2ac8cb457
SHA1 c66ea296401994d1d352b2795b70dd38f7eb4f88
SHA512 f3f473a6e7335b39cdd212ce287070e2f092cc550bd836ca66808b3483ef48c6152ad41a5f9a120c22c268af3960768b6fb7e03a8861bf444052c7cf1476229f
SSDEEP 12288:sctmABdVLhcA9D/4BjCAYEKRkx/yX0chSSuPA:sqdpkBtqoaXLMS+
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

154.16.106.40:4441

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/1416-143-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/1416-146-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/1416-147-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat
behavioral2/memory/1416-148-0x0000000000400000-0x0000000000568000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Control Panel\International\Geo\Nation	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4296	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 4296	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	87
PID 1588 wrote to memory of 4296	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	87
PID 1588 wrote to memory of 4296	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	87
PID 1588 wrote to memory of 2228	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	89
PID 1588 wrote to memory of 2228	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	89
PID 1588 wrote to memory of 2228	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	89
PID 1588 wrote to memory of 5032	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	90
PID 1588 wrote to memory of 5032	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	90
PID 1588 wrote to memory of 5032	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	90
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91
PID 1588 wrote to memory of 1416	1588	f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe	91

C:\Users\Admin\AppData\Local\Temp\f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
"C:\Users\Admin\AppData\Local\Temp\f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rsbXbxKsuHPWo" /XML "C:\Users\Admin\AppData\Local\Temp\tmpFB0E.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:4296
- C:\Users\Admin\AppData\Local\Temp\f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
  "{path}"
  2⤵
  PID:2228
- C:\Users\Admin\AppData\Local\Temp\f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
  "{path}"
  2⤵
  PID:5032
- C:\Users\Admin\AppData\Local\Temp\f5e9af8a842e3d0ab3b48e83151a43a1514ed4f8772da1819d27558b62901b3b.exe
  "{path}"
  2⤵
  PID:1416

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpFB0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpFB0E.tmp
Size 1KB
SHA256 35c16aed55b158273e0dd351b9f65ec4125b5ba2d40fde848bde8be82aa54961
MD5 61cd25d0df5ac6ba0f576e2685f4001e
SHA1 d8292a1c9bc9602eb19336a6fadd592a91bea378
SHA512 9f9e67aa4745737c3de459676d6569f769b7f6338c222d452f276715089f0146ea20000949a79e3d2158acacf6abdefafb4a7b14b7a3030da29fd45988b88ab6
MD5 SHA1 SHA512

Submit Download

memory/1416-143-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/1416-146-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/1416-147-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/1416-148-0x0000000000400000-0x0000000000568000-memory.dmp

Download

memory/1588-133-0x0000000000C10000-0x0000000000CA6000-memory.dmp

Download

memory/1588-134-0x0000000005CF0000-0x0000000006294000-memory.dmp

Download

memory/1588-135-0x0000000005740000-0x00000000057D2000-memory.dmp

Download

memory/1588-136-0x00000000057E0000-0x000000000587C000-memory.dmp

Download

memory/1588-137-0x0000000005650000-0x000000000565A000-memory.dmp

Download

memory/1588-138-0x0000000005A10000-0x0000000005A20000-memory.dmp

Download

memory/1588-139-0x0000000005A10000-0x0000000005A20000-memory.dmp

Download