warzonerat | 80da1b7360c8d9aa99ae826402e7232f5b2b1112a81bd29765596a60c8502c66

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
06/01/2024, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
server1.exe
Size 580KB
Sample240106-wrfdhsdbhn
SHA256 80da1b7360c8d9aa99ae826402e7232f5b2b1112a81bd29765596a60c8502c66
MD5 6c6b4b50258f73741044e91698ff2254
SHA1 2c5878b20138b1d6844633cd63c40ecc14fa8315
SHA512 5c1b811a904ba1bd4ee825505b2ecb82bacfb31096174f429c05b5f4d8bd9984438167a27bfd75e9bb0330954616d010fde63c1491578fdf2417b17d0851cc30
SSDEEP 12288:LS+BOhi1LV33sNBMZ/WgsLebIr5d6o3/q/uK8LXxkRmzbUdVGqFLtomp:nBXdMBM5ILebc5hqFLtos
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

satgobleien.jumpingcrab.com:5201

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 9 IoCs

rat

resource	yara_rule
behavioral2/memory/2916-9-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2916-14-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2916-18-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2828-16-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2828-19-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/2916-24-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1272-35-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1272-33-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1272-36-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 3 IoCs

pid	Process
4900	vimages.exe
1040	vimages.exe
1272	vimages.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vimages = "C:\\ProgramData\\vimages.exe"	server1.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 4540 set thread context of 2916	4540	server1.exe	92
PID 4540 set thread context of 2828	4540	server1.exe	93
PID 4900 set thread context of 1040	4900	vimages.exe	95
PID 4900 set thread context of 1272	4900	vimages.exe	99

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4876	1040	WerFault.exe	95

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	server1.exe
Token: SeDebugPrivilege	4900	vimages.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2916	4540	server1.exe	92
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 4540 wrote to memory of 2828	4540	server1.exe	93
PID 2916 wrote to memory of 4900	2916	server1.exe	94
PID 2916 wrote to memory of 4900	2916	server1.exe	94
PID 2916 wrote to memory of 4900	2916	server1.exe	94
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1040	4900	vimages.exe	95
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99
PID 4900 wrote to memory of 1272	4900	vimages.exe	99

C:\Users\Admin\AppData\Local\Temp\server1.exe
"C:\Users\Admin\AppData\Local\Temp\server1.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Users\Admin\AppData\Local\Temp\server1.exe
  C:\Users\Admin\AppData\Local\Temp\server1.exe
  2⤵
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\ProgramData\vimages.exe
    "C:\ProgramData\vimages.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4900
  - - C:\ProgramData\vimages.exe
      C:\ProgramData\vimages.exe
      4⤵
      Executes dropped EXE
      PID:1040
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1040 -s 80
        5⤵
        Program crash
        
        PID:4876
  - - C:\ProgramData\vimages.exe
      C:\ProgramData\vimages.exe
      4⤵
      Executes dropped EXE
      PID:1272
- C:\Users\Admin\AppData\Local\Temp\server1.exe
  C:\Users\Admin\AppData\Local\Temp\server1.exe
  2⤵
  PID:2828

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1040 -ip 1040
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1272-36-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1272-33-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1272-35-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2828-19-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2828-16-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2916-14-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2916-24-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2916-18-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/2916-9-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/4540-6-0x00000000053C0000-0x0000000005964000-memory.dmp

Download

memory/4540-7-0x0000000004EB0000-0x0000000004F42000-memory.dmp

Download

memory/4540-17-0x0000000074970000-0x0000000075120000-memory.dmp

Download

memory/4540-8-0x0000000004BA0000-0x0000000004BA6000-memory.dmp

Download

memory/4540-4-0x00000000049D0000-0x0000000004A62000-memory.dmp

Download

memory/4540-0-0x0000000000130000-0x00000000001CA000-memory.dmp

Download

memory/4540-5-0x0000000004D70000-0x0000000004E0C000-memory.dmp

Download

memory/4540-3-0x0000000004A90000-0x0000000004AA0000-memory.dmp

Download

memory/4540-2-0x0000000000C20000-0x0000000000C26000-memory.dmp

Download

memory/4540-1-0x0000000074970000-0x0000000075120000-memory.dmp

Download

memory/4900-25-0x00000000742E0000-0x0000000074A90000-memory.dmp

Download

memory/4900-26-0x0000000004E20000-0x0000000004E30000-memory.dmp

Download

memory/4900-34-0x00000000742E0000-0x0000000074A90000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads