warzonerat | 4d5e40a9df086bb3dc150c2ab0a411234f155864007ba9fe654d1b071dc3ecaf

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2023, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe
Size

215KB
MD5

5d278b330412fc5f0b05a6168e4663f7
SHA1

afebf776b4cdcfa12dc38d7aab0190820a956057
SHA256

6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e
SHA512

4c7204ac871350fcb6c4e4a745fd2f7482afa152e0cdd7e4097aaa427d1911b6fe038b366cba5acad1243e209643634c2ea48ad4c613a34c2488eb1fcf3ef275
SSDEEP

3072:2fY/TU9fE9PEtuFbzrF+aj3dFzFNqdTGi7Gb2QmBAZdWlqLGCZM4fNmBvqNxHFgz:gYa6XzrFrbDqVGd6AZdwINmlq1gqg

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

osairus.duckdns.org:4244

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 3 IoCs

rat

resource	yara_rule
behavioral2/memory/2280-140-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/2280-142-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/2280-144-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Loads dropped DLL 1 IoCs

pid	Process
1280	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\xhdmvqavfoktdy = "C:\\Users\\Admin\\AppData\\Roaming\\dyirm\\vfbkgpyuenjso.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\6ab689435a51068b3f0520391d4a037dccf43bfd"	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1280 set thread context of 2280	1280	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1280	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2280	1280	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe	85
PID 1280 wrote to memory of 2280	1280	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe	85
PID 1280 wrote to memory of 2280	1280	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe	85
PID 1280 wrote to memory of 2280	1280	6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe	85

C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe
"C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe
  "C:\Users\Admin\AppData\Local\Temp\6ab689435a51068b3f0520391d4a037dccf43bfdaa3e1a1b545a85c89aa9473e.exe"
  2⤵
  PID:2280

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nslCB55.tmp\dpvhuhc.dll

Filesize
86KB

MD5
1627f1115a794fbec36c674297f31fb4

SHA1
7cbd5122f668be131d041395c462c1cfea76c1f0

SHA256
c6d8e109a8a3b7d4944fd258ab065229decaad0daa1e9a0007c34119158d6af9

SHA512
811f820f0ef8ace011c2b9f8bae613ed040aaaf49888609d9043184c5f17393ea3281ba266b25693ab96f22dc94e69f475be761d41eb5dfee9afce8637038e24

Download Submit
memory/1280-143-0x0000000003270000-0x0000000003273000-memory.dmp

Filesize
12KB

Download
memory/2280-140-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2280-142-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2280-144-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download