warzonerat | 8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559c

General

Target

NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe
Size

1003KB
MD5

818f32d7b8abb99fdfb0c28e2e971064
SHA1

09f06d3690420c524366c241f0fc04ddf101c948
SHA256

8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559c
SHA512

2aab73204bc41aa2c8a91b9be295cea4b6ef3ca8c377027994fb2258c5ddafc791ef5644f0dc4938a612e36a2e49dbff3e24f6f7d02b7d2b915cb99235b2f4f6
SSDEEP

12288:GBvSZbk0WXlBx4+K5jFY4IGW5SDTrWRJmSqKp9TV1gSx1yN5K7q:DPj0GNTyRJ0jKG

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

38.255.42.252:5678

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 6 IoCs

rat

resource	yara_rule
behavioral1/memory/2800-12-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2800-13-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2800-15-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2800-16-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2800-18-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2800-21-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 764 set thread context of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2832	2800	WerFault.exe	28

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe
764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 764 wrote to memory of 2800	764	NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe	28
PID 2800 wrote to memory of 2832	2800	MSBuild.exe	29
PID 2800 wrote to memory of 2832	2800	MSBuild.exe	29
PID 2800 wrote to memory of 2832	2800	MSBuild.exe	29
PID 2800 wrote to memory of 2832	2800	MSBuild.exe	29

C:\Users\Admin\AppData\Local\Temp\NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8babd1b12db5aa7c49b748e6cd0a558e8eba4c694f439e9258ac50d7fccf559cexe_JC.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2800
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2800 -s 200
    3⤵
    - Program crash
    PID:2832

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/764-0-0x0000000000290000-0x0000000000390000-memory.dmp

Filesize
1024KB

Download
memory/764-1-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/764-2-0x0000000004880000-0x00000000048C0000-memory.dmp

Filesize
256KB

Download
memory/764-3-0x00000000005E0000-0x00000000005FE000-memory.dmp

Filesize
120KB

Download
memory/764-4-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/764-5-0x0000000004880000-0x00000000048C0000-memory.dmp

Filesize
256KB

Download
memory/764-6-0x0000000000600000-0x000000000060C000-memory.dmp

Filesize
48KB

Download
memory/764-7-0x0000000000710000-0x0000000000720000-memory.dmp

Filesize
64KB

Download
memory/764-8-0x00000000047C0000-0x000000000481E000-memory.dmp

Filesize
376KB

Download
memory/764-20-0x0000000074B90000-0x000000007527E000-memory.dmp

Filesize
6.9MB

Download
memory/2800-10-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-11-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-12-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-13-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-15-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-16-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-17-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2800-18-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-9-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2800-21-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing