warzonerat | 3c36d574e4005d919706e2945a25f6704d48ea69b5960bdc544e59cc4e3295cc

Analysis

max time kernel
142s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
16/12/2023, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f525808e3a1d0040b3c60e5940f250fe.exe
Size 313KB
Sample231216-ts3jbsdee4
SHA256 3c36d574e4005d919706e2945a25f6704d48ea69b5960bdc544e59cc4e3295cc
MD5 f525808e3a1d0040b3c60e5940f250fe
SHA1 4612a5e55540ff65aff96ab95ed8446e923443df
SHA512 004a50b01357f9b2b77de48553754adf766488ed2f48a332ae9e767d7340c376430ed3fb76eca02016f8bd2defb3f11c15da6e26db3537ea83c17b0772417d77
SSDEEP 6144:2BlL/Zde0zS/srkaLdInw5OFtoLTAzcO78ToYJyeNaXt:UFeiS0rkydboofAgOHReNaXt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

mcwillis.duckdns.org:5122

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3492-8-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/3492-11-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/3492-12-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral2/memory/3492-13-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
4116	bficsgotez.exe
3492	bficsgotez.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nwggbkggp = "C:\\Users\\Admin\\AppData\\Roaming\\luqqajjfo\\oxttdyiirn.exe \"C:\\Users\\Admin\\AppData\\Local\\Temp\\bficsgotez.exe\" "	bficsgotez.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4116 set thread context of 3492	4116	bficsgotez.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
4116	bficsgotez.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 4116	680	f525808e3a1d0040b3c60e5940f250fe.exe	90
PID 680 wrote to memory of 4116	680	f525808e3a1d0040b3c60e5940f250fe.exe	90
PID 680 wrote to memory of 4116	680	f525808e3a1d0040b3c60e5940f250fe.exe	90
PID 4116 wrote to memory of 3492	4116	bficsgotez.exe	93
PID 4116 wrote to memory of 3492	4116	bficsgotez.exe	93
PID 4116 wrote to memory of 3492	4116	bficsgotez.exe	93
PID 4116 wrote to memory of 3492	4116	bficsgotez.exe	93

C:\Users\Admin\AppData\Local\Temp\f525808e3a1d0040b3c60e5940f250fe.exe
"C:\Users\Admin\AppData\Local\Temp\f525808e3a1d0040b3c60e5940f250fe.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:680
- C:\Users\Admin\AppData\Local\Temp\bficsgotez.exe
  "C:\Users\Admin\AppData\Local\Temp\bficsgotez.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:4116
- - C:\Users\Admin\AppData\Local\Temp\bficsgotez.exe
    "C:\Users\Admin\AppData\Local\Temp\bficsgotez.exe"
    3⤵
    - Executes dropped EXE
    PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

bficsgotez.exe

Path C:\Users\Admin\AppData\Local\Temp\bficsgotez.exe
Size 84KB
SHA256 c0fb4b74f0d26926680cbb7cda2fd21412061cd0169b4ab96e9f2561f508cd47
MD5 3bde622bfa7a14ea5c2730543d7b0d10
SHA1 32165962525dcffaa79f24c79a45c4caba12d61c
SHA512 e6e9e4aa2289500af3887bbf0567c94928b6338b4284cc30162cfc84026ac252591f99473d815653684b5ab450fb7acfc146048cdbc0bc187226afd89aad79ce
SSDEEP 1536:SuKWdOgJeofFMKPSBPZ8+naOdxiQ4YSPVwTc1swWoubmfs7ATpOpoPwzXeY:rOgJeot8BPZmOdxi+S9B1sPJFATCzuY
MD5 SHA1 SHA512 SSDEEP

Submit Download

qvepylau.z

Path C:\Users\Admin\AppData\Local\Temp\qvepylau.z
Size 118KB
SHA256 3e16c4164bec2e7cb59fb281b2507405cace9b5e7b59a5933d2c93445a87cb42
MD5 4914a24a75a8d9f09bcc9823547206d5
SHA1 80737aab1e10bd124c12d8002abb51947ab3a45e
SHA512 64e5ea10d473e8f47fc3d0b169607fe59be25a5d07e63976cec9e2ce0352ac00b1e56a9b2834ee132a4695503192f0d812e967824d00a8867c09cb9737d35f39
SSDEEP 3072:PcXE5+FabKlgqTKGdNN0BVBZCY/qoHbvrMkfTz2B4g:0XZabKMGdNNyBUZoHTDeB7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3492-8-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3492-11-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3492-12-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/3492-13-0x0000000000400000-0x000000000041D000-memory.dmp

Download

memory/4116-5-0x0000000000C50000-0x0000000000C52000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads