warzonerat | b73e195266df81de789d37b4659da0467f9cdae883642341b45722a931b47620

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
08/08/2023, 18:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

PURCHASE ORDER.exe
Size

678KB
MD5

a2fe6a19174c433e304629876ae3e83e
SHA1

7fdfd511b37459a131acba5fd4cfaeac2596bb00
SHA256

4aed7e79799b99831a8e43da5e4ead88792f7852560cfe80aab8fc3663aa0c14
SHA512

a3f6cfa1255b06fafd6e0b43d3d4be92fccd5cc9786e4b838eb0c9926e19c356536a2406a0ca935181c882d8d14016df5552d5d91ba9a29b4b93c47934a9c31e
SSDEEP

6144:WYa6wA+J7XPJnad1zbOJY5uW8lhpx0o36:WYyAQ7fJnynOhA

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

103.212.81.157:5167

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral1/memory/2360-63-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/2360-65-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/2360-66-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/2360-71-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat

Loads dropped DLL 1 IoCs

pid	Process
1548	PURCHASE ORDER.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4219371764-2579186923-3390623117-1000\Software\Microsoft\Windows\CurrentVersion\Run\qajfoktdyir = "C:\\Users\\Admin\\AppData\\Roaming\\qmvfbktpyue\\njsbwgclu.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\PURCHASE ORDER.exe\""	PURCHASE ORDER.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1548 set thread context of 2360	1548	PURCHASE ORDER.exe	28

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1548	PURCHASE ORDER.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 2360	1548	PURCHASE ORDER.exe	28
PID 1548 wrote to memory of 2360	1548	PURCHASE ORDER.exe	28
PID 1548 wrote to memory of 2360	1548	PURCHASE ORDER.exe	28
PID 1548 wrote to memory of 2360	1548	PURCHASE ORDER.exe	28
PID 1548 wrote to memory of 2360	1548	PURCHASE ORDER.exe	28
PID 2360 wrote to memory of 2412	2360	PURCHASE ORDER.exe	29
PID 2360 wrote to memory of 2412	2360	PURCHASE ORDER.exe	29
PID 2360 wrote to memory of 2412	2360	PURCHASE ORDER.exe	29
PID 2360 wrote to memory of 2412	2360	PURCHASE ORDER.exe	29
PID 2360 wrote to memory of 2412	2360	PURCHASE ORDER.exe	29
PID 2360 wrote to memory of 2412	2360	PURCHASE ORDER.exe	29

C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
"C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe
  "C:\Users\Admin\AppData\Local\Temp\PURCHASE ORDER.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2360
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsd7D2D.tmp\esruijyxsj.dll

Filesize
60KB

MD5
0f19cd2a3143f61147aae6ad56c00224

SHA1
8874d0304b717a87871b35a688dec09e5493b05f

SHA256
8e1c1decdaa34d7c990dbe1b993a72c5e56ca685747bd6cbd4283eb89f3ff1ae

SHA512
0345a7cf578d4adc4935ee24ce84b0877848eeb78e72608c29e6c14f95890ae07bd7e8bfdc3bfd73a58b2ceb3d2219c8cebfae6a680418edb397ef31ab22acbc

Download Submit
\Users\Admin\AppData\Local\Temp\nsd7D2D.tmp\esruijyxsj.dll

Filesize
60KB

MD5
0f19cd2a3143f61147aae6ad56c00224

SHA1
8874d0304b717a87871b35a688dec09e5493b05f

SHA256
8e1c1decdaa34d7c990dbe1b993a72c5e56ca685747bd6cbd4283eb89f3ff1ae

SHA512
0345a7cf578d4adc4935ee24ce84b0877848eeb78e72608c29e6c14f95890ae07bd7e8bfdc3bfd73a58b2ceb3d2219c8cebfae6a680418edb397ef31ab22acbc

Download Submit
memory/1548-61-0x00000000003E0000-0x00000000003E2000-memory.dmp

Filesize
8KB

Download
memory/2360-63-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2360-65-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2360-66-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2360-71-0x0000000000400000-0x000000000055E000-memory.dmp

Filesize
1.4MB

Download
memory/2412-67-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download
memory/2412-68-0x0000000000160000-0x0000000000161000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads