warzonerat | ed157c803957abb679a042de81c95ffa68ea8367b14ca1ffacca1d20cedecd0b

Analysis

max time kernel
31s
max time network
34s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30/03/2023, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
Size 479KB
Sample230330-bc4scaca9w
SHA256 5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24
MD5 1554965f5e94f2742a86f080c829e6c6
SHA1 3b31d6f522525cafaccfd4b843d4224a733831c8
SHA512 e3151beb8aa7682cfabfb32c161760527f449a18b7b9ef4c6f3a8e337775c5fd64c8ffe5eee0330c832e08fe38b4e7a5aee552660d0ecdede89e3b06e13ec853
SSDEEP 12288:IgkU2UTwmK64YcJkbx8TIFeHMif9po6vAh7BCOIBw8x9d:xRTFqHc8UyMifbNvAhdC/O8t
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat evasion infostealer persistence rat trojan

Malware Config

Extracted

Family

warzonerat

panchak.duckdns.org:5050

Signatures

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/1220-64-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Checks whether UAC is enabled 1 TTPs 2 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 932 set thread context of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
544	1220	WerFault.exe	35

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
268	powershell.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
Token: SeLoadDriverPrivilege	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
Token: SeDebugPrivilege	268	powershell.exe
Token: SeDebugPrivilege	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 932 wrote to memory of 268	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	28
PID 932 wrote to memory of 268	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	28
PID 932 wrote to memory of 268	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	28
PID 932 wrote to memory of 1828	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	30
PID 932 wrote to memory of 1828	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	30
PID 932 wrote to memory of 1828	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	30
PID 932 wrote to memory of 1004	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	31
PID 932 wrote to memory of 1004	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	31
PID 932 wrote to memory of 1004	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	31
PID 932 wrote to memory of 1780	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	32
PID 932 wrote to memory of 1780	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	32
PID 932 wrote to memory of 1780	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	32
PID 932 wrote to memory of 1308	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	33
PID 932 wrote to memory of 1308	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	33
PID 932 wrote to memory of 1308	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	33
PID 932 wrote to memory of 1444	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	34
PID 932 wrote to memory of 1444	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	34
PID 932 wrote to memory of 1444	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	34
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 932 wrote to memory of 1220	932	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe	35
PID 1220 wrote to memory of 544	1220	SetupUtility.exe	36
PID 1220 wrote to memory of 544	1220	SetupUtility.exe	36
PID 1220 wrote to memory of 544	1220	SetupUtility.exe	36
PID 1220 wrote to memory of 544	1220	SetupUtility.exe	36

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe

C:\Users\Admin\AppData\Local\Temp\5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe
"C:\Users\Admin\AppData\Local\Temp\5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe"
1⤵
- UAC bypass
- Sets service image path in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5d4ad8679dc296d63c7641cea5ad5948fd33d3b70bfa336771a4f7ba35338a24.exe" -Force
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:268
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:1828
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:1004
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:1780
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:1308
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
  2⤵
  PID:1444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1220
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 168
    3⤵
    - Program crash
    PID:544

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scripting

T1064

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/268-62-0x000000001B300000-0x000000001B5E2000-memory.dmp

Download

memory/268-63-0x0000000002310000-0x0000000002318000-memory.dmp

Download

memory/268-65-0x0000000002440000-0x00000000024C0000-memory.dmp

Download

memory/268-66-0x0000000002440000-0x00000000024C0000-memory.dmp

Download

memory/268-67-0x0000000002440000-0x00000000024C0000-memory.dmp

Download

memory/268-68-0x0000000002440000-0x00000000024C0000-memory.dmp

Download

memory/932-54-0x0000000000340000-0x00000000003BC000-memory.dmp

Download

memory/932-55-0x000000001B380000-0x000000001B400000-memory.dmp

Download

memory/932-56-0x00000000020D0000-0x0000000002132000-memory.dmp

Download

memory/1220-64-0x0000000000400000-0x0000000000554000-memory.dmp

Download