warzonerat | 871978fb97af5fca44a98714b79a3e86dfdb468eed6980dadc7f2bf7e5bf1aaa

Resubmissions

06/11/2023, 19:37

231106-ybwfxadf81 10

06/11/2023, 19:33

231106-x9tjjadf4z 10

06/11/2023, 16:18

231106-tr58tscc9y 10

Analysis

max time kernel
149s
max time network
157s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 19:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1106-04-Warzone.exe
Size

191KB
MD5

996dd49201700930e0196a0b06f2a540
SHA1

96c2cacce22898106473c1caef52f52cef7bb86d
SHA256

d67122e881107797472553cc88f939e134c6443a435308e1333f4fb43dc59ff1
SHA512

76820043e1b61c3892c92fcd552bb539cf333d52de7ca73db118ef7981b930d864629bb8bd075ca8a48b97a9790eb209233f0ce77faa149dbbdc3e2f5f70583b
SSDEEP

3072:YkmlIja3IsCmIvI1zSIdPauWk9qtZHhUZ7OybN/AyoOzldQuoDm2heF1:YJ6aCtUzFUuMtZHx6zBZdQuoDVeF

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

103.212.81.154:6028

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

resource	yara_rule
behavioral7/memory/2376-7-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat
behavioral7/memory/2376-8-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat
behavioral7/memory/2376-10-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat
behavioral7/memory/2376-12-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat
behavioral7/memory/2376-17-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat
behavioral7/memory/2376-23-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat
behavioral7/memory/2376-28-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat
behavioral7/memory/2376-29-0x0000000000110000-0x000000000026C000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1180 set thread context of 2376	1180	1106-04-Warzone.exe	29

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2860	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2860	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 1180 wrote to memory of 2376	1180	1106-04-Warzone.exe	29
PID 2376 wrote to memory of 2860	2376	RegAsm.exe	30
PID 2376 wrote to memory of 2860	2376	RegAsm.exe	30
PID 2376 wrote to memory of 2860	2376	RegAsm.exe	30
PID 2376 wrote to memory of 2860	2376	RegAsm.exe	30
PID 2376 wrote to memory of 2272	2376	RegAsm.exe	32
PID 2376 wrote to memory of 2272	2376	RegAsm.exe	32
PID 2376 wrote to memory of 2272	2376	RegAsm.exe	32
PID 2376 wrote to memory of 2272	2376	RegAsm.exe	32
PID 2376 wrote to memory of 2272	2376	RegAsm.exe	32
PID 2376 wrote to memory of 2272	2376	RegAsm.exe	32

C:\Users\Admin\AppData\Local\Temp\1106-04-Warzone.exe
"C:\Users\Admin\AppData\Local\Temp\1106-04-Warzone.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2376
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:2272

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1180-20-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/1180-0-0x0000000000370000-0x00000000003A6000-memory.dmp

Filesize
216KB

Download
memory/1180-2-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/1180-3-0x00000000005B0000-0x00000000005D8000-memory.dmp

Filesize
160KB

Download
memory/1180-1-0x0000000074D80000-0x000000007546E000-memory.dmp

Filesize
6.9MB

Download
memory/2272-37-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2272-39-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2376-6-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-29-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-10-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-12-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2376-7-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-17-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-23-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-28-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-8-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-4-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2376-5-0x0000000000110000-0x000000000026C000-memory.dmp

Filesize
1.4MB

Download
memory/2860-34-0x0000000002150000-0x0000000002190000-memory.dmp

Filesize
256KB

Download
memory/2860-35-0x0000000002150000-0x0000000002190000-memory.dmp

Filesize
256KB

Download
memory/2860-36-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-33-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download
memory/2860-32-0x0000000073C70000-0x000000007421B000-memory.dmp

Filesize
5.7MB

Download