warzonerat | 871978fb97af5fca44a98714b79a3e86dfdb468eed6980dadc7f2bf7e5bf1aaa

Resubmissions

06/11/2023, 19:37

231106-ybwfxadf81 10

06/11/2023, 19:33

231106-x9tjjadf4z 10

06/11/2023, 16:18

231106-tr58tscc9y 10

Analysis

max time kernel
1196s
max time network
1210s
platform
windows10-1703_x64
resource
win10-20231020-en
resource tags

arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system
submitted
06/11/2023, 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1106-04-Warzone.exe
Size

191KB
MD5

996dd49201700930e0196a0b06f2a540
SHA1

96c2cacce22898106473c1caef52f52cef7bb86d
SHA256

d67122e881107797472553cc88f939e134c6443a435308e1333f4fb43dc59ff1
SHA512

76820043e1b61c3892c92fcd552bb539cf333d52de7ca73db118ef7981b930d864629bb8bd075ca8a48b97a9790eb209233f0ce77faa149dbbdc3e2f5f70583b
SSDEEP

3072:YkmlIja3IsCmIvI1zSIdPauWk9qtZHhUZ7OybN/AyoOzldQuoDm2heF1:YJ6aCtUzFUuMtZHx6zBZdQuoDVeF

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

103.212.81.154:6028

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral7/memory/3048-5-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat
behavioral7/memory/3048-9-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat
behavioral7/memory/3048-11-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat
behavioral7/memory/3048-121-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4412 set thread context of 3048	4412	1106-04-Warzone.exe	72

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5048	powershell.exe
5048	powershell.exe
5048	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5048	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 4412 wrote to memory of 3048	4412	1106-04-Warzone.exe	72
PID 3048 wrote to memory of 5048	3048	RegAsm.exe	73
PID 3048 wrote to memory of 5048	3048	RegAsm.exe	73
PID 3048 wrote to memory of 5048	3048	RegAsm.exe	73
PID 3048 wrote to memory of 4728	3048	RegAsm.exe	75
PID 3048 wrote to memory of 4728	3048	RegAsm.exe	75
PID 3048 wrote to memory of 4728	3048	RegAsm.exe	75
PID 3048 wrote to memory of 4728	3048	RegAsm.exe	75
PID 3048 wrote to memory of 4728	3048	RegAsm.exe	75

C:\Users\Admin\AppData\Local\Temp\1106-04-Warzone.exe
"C:\Users\Admin\AppData\Local\Temp\1106-04-Warzone.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4728

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lkbux0vf.k1r.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
memory/3048-5-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/3048-9-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/3048-11-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/3048-121-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/4412-0-0x0000000000A50000-0x0000000000A86000-memory.dmp

Filesize
216KB

Download
memory/4412-1-0x0000000073580000-0x0000000073C6E000-memory.dmp

Filesize
6.9MB

Download
memory/4412-2-0x00000000053A0000-0x0000000005406000-memory.dmp

Filesize
408KB

Download
memory/4412-3-0x0000000005500000-0x0000000005510000-memory.dmp

Filesize
64KB

Download
memory/4412-4-0x0000000005370000-0x0000000005398000-memory.dmp

Filesize
160KB

Download
memory/4412-8-0x0000000073580000-0x0000000073C6E000-memory.dmp

Filesize
6.9MB

Download
memory/4728-51-0x0000000000A70000-0x0000000000A71000-memory.dmp

Filesize
4KB

Download
memory/5048-21-0x0000000007E40000-0x0000000008190000-memory.dmp

Filesize
3.3MB

Download
memory/5048-43-0x00000000095A0000-0x00000000095BE000-memory.dmp

Filesize
120KB

Download
memory/5048-19-0x0000000007A70000-0x0000000007A92000-memory.dmp

Filesize
136KB

Download
memory/5048-20-0x0000000007B10000-0x0000000007B76000-memory.dmp

Filesize
408KB

Download
memory/5048-17-0x0000000006DD0000-0x0000000006DE0000-memory.dmp

Filesize
64KB

Download
memory/5048-22-0x0000000007BE0000-0x0000000007BFC000-memory.dmp

Filesize
112KB

Download
memory/5048-23-0x00000000083E0000-0x000000000842B000-memory.dmp

Filesize
300KB

Download
memory/5048-24-0x0000000008520000-0x0000000008596000-memory.dmp

Filesize
472KB

Download
memory/5048-16-0x0000000006DD0000-0x0000000006DE0000-memory.dmp

Filesize
64KB

Download
memory/5048-41-0x00000000095E0000-0x0000000009613000-memory.dmp

Filesize
204KB

Download
memory/5048-42-0x00000000710E0000-0x000000007112B000-memory.dmp

Filesize
300KB

Download
memory/5048-18-0x0000000007410000-0x0000000007A38000-memory.dmp

Filesize
6.2MB

Download
memory/5048-48-0x0000000009710000-0x00000000097B5000-memory.dmp

Filesize
660KB

Download
memory/5048-49-0x0000000006DD0000-0x0000000006DE0000-memory.dmp

Filesize
64KB

Download
memory/5048-50-0x00000000098C0000-0x0000000009954000-memory.dmp

Filesize
592KB

Download
memory/5048-14-0x0000000072F20000-0x000000007360E000-memory.dmp

Filesize
6.9MB

Download
memory/5048-15-0x0000000006D40000-0x0000000006D76000-memory.dmp

Filesize
216KB

Download
memory/5048-137-0x0000000072F20000-0x000000007360E000-memory.dmp

Filesize
6.9MB

Download
memory/5048-247-0x0000000007070000-0x000000000708A000-memory.dmp

Filesize
104KB

Download
memory/5048-252-0x0000000007060000-0x0000000007068000-memory.dmp

Filesize
32KB

Download
memory/5048-268-0x0000000072F20000-0x000000007360E000-memory.dmp

Filesize
6.9MB

Download