warzonerat | 0e56b689196e7f1ddef9fad8cc6db33ba3bcc529b1ddb9cd5940ae206289d667

Resubmissions

09/06/2023, 01:23

230609-br7gsabc8y10

07/06/2023, 09:00

230607-kyawtshh6t10

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2023, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b682e3dc1f18c1131f75ff8582aa5703.exe
Size 174KB
Sample230609-br7gsabc8y
SHA256 0e56b689196e7f1ddef9fad8cc6db33ba3bcc529b1ddb9cd5940ae206289d667
MD5 b682e3dc1f18c1131f75ff8582aa5703
SHA1 3469dd3c70a3ee99ece17b22b4ffe01ed806404a
SHA512 7d279f652bd1817d5d5a0330865c1ab04b11c7597515120756d2db7ef97e37c2628d9790ed843d94744b602dba73346bea8542ab384209b4e93a172c2b206465
SSDEEP 3072:68MvVo31JZfOQtO9PD6vl7fIkWEffn9ne2+6TKXeB5AlckP+tL/uZwfkR:68MvqIL6vl7fIkWK9eXC5AakP+tL/uZf
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

193.42.32.191:8282

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4604-134-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4604-137-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4604-138-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/4604-139-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1724 set thread context of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1724	b682e3dc1f18c1131f75ff8582aa5703.exe
1724	b682e3dc1f18c1131f75ff8582aa5703.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1724	b682e3dc1f18c1131f75ff8582aa5703.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 2424	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	82
PID 1724 wrote to memory of 2424	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	82
PID 1724 wrote to memory of 2424	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	82
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83
PID 1724 wrote to memory of 4604	1724	b682e3dc1f18c1131f75ff8582aa5703.exe	83

C:\Users\Admin\AppData\Local\Temp\b682e3dc1f18c1131f75ff8582aa5703.exe
"C:\Users\Admin\AppData\Local\Temp\b682e3dc1f18c1131f75ff8582aa5703.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:2424
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4604

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1724-133-0x000001C326E00000-0x000001C326E30000-memory.dmp

Download

memory/4604-134-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4604-137-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4604-138-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4604-139-0x0000000000400000-0x0000000000554000-memory.dmp

Download