warzonerat | 18fcb8604dc88c010d786be917f618a461876f5db6f80f1f8a64bc3b8fe48a98

Resubmissions

24/07/2023, 06:32

230724-haylwaag65 10

16/07/2023, 18:15

230716-wwbacshb7z 10

Analysis

max time kernel
156s
max time network
181s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
24/07/2023, 06:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
Size

643KB
MD5

e61dffb557266167a4b9c244c8c8a699
SHA1

7e0b819ba7163f7837a5fedb9d4f0cf28050a02b
SHA256

20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145
SHA512

4bc7d31c2b701eb6350c8eb14f9b7c9e9671482d487962474f8ea061b8bd7bac27165321e4837880ff7a103e9c32ae2c74f135daf43847f9e5748969c7b0a1f6
SSDEEP

12288:Cu3dK1q9I6/kldSCcSplYstzDyaod+ik4g8y3SoD:CuNKO/SvDzW2rEloD

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

158.69.115.206:5200

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

resource	yara_rule
behavioral19/memory/2716-66-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral19/memory/2716-67-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral19/memory/2716-68-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral19/memory/2716-70-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral19/memory/2716-74-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral19/memory/2716-77-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral19/memory/2716-78-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral19/memory/2716-79-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2832 set thread context of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
2236	schtasks.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2236	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	30
PID 2832 wrote to memory of 2236	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	30
PID 2832 wrote to memory of 2236	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	30
PID 2832 wrote to memory of 2236	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	30
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32
PID 2832 wrote to memory of 2716	2832	20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe	32

C:\Users\Admin\AppData\Local\Temp\20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
"C:\Users\Admin\AppData\Local\Temp\20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\claEBJylszqC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp85F2.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\20573eab37017ad0c5ad37228fdcc5e6f5c64dddbb275f50ee4dcc8dc3d43145.exe
  "{path}"
  2⤵
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp85F2.tmp

Filesize
1KB

MD5
c731935ccb31f3fe5f40356feb5be9c4

SHA1
dfaf0bfa418470385a9ee8db240e111eb9419ac8

SHA256
0abb2c63c28d4cdddc603be98d758f666883f022ad1692fa8c074b87133e5760

SHA512
b93f803db14655eb6a4a6db98383815e3caa936598cc30c98b72300de37f7d354d97d74637546443fb377133589af8fd606177b4e62e5820c886f93e915c3f4e

Download Submit
memory/2716-74-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2716-79-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-66-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-78-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-77-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-64-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-63-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-65-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-67-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-70-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2716-68-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2832-58-0x0000000004B40000-0x0000000004B80000-memory.dmp

Filesize
256KB

Download
memory/2832-56-0x00000000001B0000-0x00000000001BA000-memory.dmp

Filesize
40KB

Download
memory/2832-54-0x00000000013D0000-0x0000000001478000-memory.dmp

Filesize
672KB

Download
memory/2832-76-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2832-55-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download
memory/2832-59-0x0000000000600000-0x000000000062A000-memory.dmp

Filesize
168KB

Download
memory/2832-57-0x00000000743B0000-0x0000000074A9E000-memory.dmp

Filesize
6.9MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads