warzonerat | bdfabc2afce989e2dab48f9f8d04db605b9c29802fa95fe559f6cb9898da39e2

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 10:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
INV0038234323.exe
Size 526KB
Sample231016-l5mpmsdc71
SHA256 bdfabc2afce989e2dab48f9f8d04db605b9c29802fa95fe559f6cb9898da39e2
MD5 77e2b4d9a9eeb62ca36e241d6c193c19
SHA1 6af3c23f5484b2e994c9d00b7f038cf7ac85787f
SHA512 28da65083d065684181735f314ac9d63802b8eb1014ce62c72bf492b204bbfc3c9406cb4ac914e716d06a4f0af943280164c79dabb6da11eb3eebc9f0106e947
SSDEEP 12288:KzfqBuxZTH2IcvrPklZRSkfXksQDueRvM8yz5pmX:KT6Yb2PvowkfXksQDueRvM8EmX
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

173.249.196.201:5077

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/2184-12-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2184-15-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2184-16-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2184-18-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4560 set thread context of 2184	4560	INV0038234323.exe	94

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4560	INV0038234323.exe
4560	INV0038234323.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	INV0038234323.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4560 wrote to memory of 4324	4560	INV0038234323.exe	93
PID 4560 wrote to memory of 4324	4560	INV0038234323.exe	93
PID 4560 wrote to memory of 4324	4560	INV0038234323.exe	93
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94
PID 4560 wrote to memory of 2184	4560	INV0038234323.exe	94

C:\Users\Admin\AppData\Local\Temp\INV0038234323.exe
"C:\Users\Admin\AppData\Local\Temp\INV0038234323.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4560
- C:\Users\Admin\AppData\Local\Temp\INV0038234323.exe
  "C:\Users\Admin\AppData\Local\Temp\INV0038234323.exe"
  2⤵
  PID:4324
- C:\Users\Admin\AppData\Local\Temp\INV0038234323.exe
  "C:\Users\Admin\AppData\Local\Temp\INV0038234323.exe"
  2⤵
  PID:2184

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2184-12-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2184-18-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2184-16-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2184-15-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4560-4-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/4560-5-0x0000000004F70000-0x0000000004F7A000-memory.dmp

Download

memory/4560-6-0x0000000005060000-0x00000000050FC000-memory.dmp

Download

memory/4560-7-0x0000000005270000-0x000000000528A000-memory.dmp

Download

memory/4560-8-0x0000000074DB0000-0x0000000075560000-memory.dmp

Download

memory/4560-9-0x0000000004FB0000-0x0000000004FC0000-memory.dmp

Download

memory/4560-10-0x0000000005250000-0x0000000005260000-memory.dmp

Download

memory/4560-11-0x0000000007C80000-0x0000000007CDC000-memory.dmp

Download

memory/4560-0-0x0000000000390000-0x000000000041A000-memory.dmp

Download

memory/4560-3-0x0000000004DB0000-0x0000000004E42000-memory.dmp

Download

memory/4560-2-0x0000000005430000-0x00000000059D4000-memory.dmp

Download

memory/4560-17-0x0000000074DB0000-0x0000000075560000-memory.dmp

Download

memory/4560-1-0x0000000074DB0000-0x0000000075560000-memory.dmp

Download