warzonerat | 2fd08e554d205eff9cc16a27e59b94abad98311738a109b8efe3523291833c3c

General

Target

afa887c1eb5644f68522d1a298942459.exe
Size

236KB
MD5

afa887c1eb5644f68522d1a298942459
SHA1

4d0feb5610502cb7f33a5d7e6e93922d6b26a1b2
SHA256

2fd08e554d205eff9cc16a27e59b94abad98311738a109b8efe3523291833c3c
SHA512

f746e91bc6981e6f53f95f032e901ddbad7edcbde004f189d350552d6f558310a0227535b8c086b5f0f88107a8e721aedf12c35764a9dcc41f9831fa642f4c23
SSDEEP

3072:PWUYAlmXkJr4Dul8kZyLA93qlUD2mvwV6bFcHSRoodGv8Z36CxVYwwBJ785v7W8g:vsBi17NCFYp3rtHmqbK65K

Score

10^/10

warzonerat evasion infostealer rat rezer0 trojan

Malware Config

Extracted

Family

warzonerat

C2

185.140.53.41:2104

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

afa887c1eb5644f68522d1a298942459.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	afa887c1eb5644f68522d1a298942459.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	afa887c1eb5644f68522d1a298942459.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	afa887c1eb5644f68522d1a298942459.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	afa887c1eb5644f68522d1a298942459.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2192-5-0x0000000000690000-0x00000000006B8000-memory.dmp	rezer0

Warzone RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2868-19-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2868-21-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2868-23-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2868-25-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2868-29-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2868-31-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2868-33-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2868-50-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

afa887c1eb5644f68522d1a298942459.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	afa887c1eb5644f68522d1a298942459.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	afa887c1eb5644f68522d1a298942459.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

afa887c1eb5644f68522d1a298942459.exe

description pid process target process

PID 2192 set thread context of 2868 2192 afa887c1eb5644f68522d1a298942459.exe afa887c1eb5644f68522d1a298942459.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exeafa887c1eb5644f68522d1a298942459.exepowershell.exe

pid process

2588 powershell.exe
2192 afa887c1eb5644f68522d1a298942459.exe
2672 powershell.exe

description	pid	process	target process
PID 2192 set thread context of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe

pid	process
2588	powershell.exe
2192	afa887c1eb5644f68522d1a298942459.exe
2672	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exeafa887c1eb5644f68522d1a298942459.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2588	powershell.exe
Token: SeDebugPrivilege	2192	afa887c1eb5644f68522d1a298942459.exe
Token: SeDebugPrivilege	2672	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

afa887c1eb5644f68522d1a298942459.exeafa887c1eb5644f68522d1a298942459.exe

description	pid	process	target process
PID 2192 wrote to memory of 2588	2192	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2192 wrote to memory of 2588	2192	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2192 wrote to memory of 2588	2192	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2192 wrote to memory of 2588	2192	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2192 wrote to memory of 2868	2192	afa887c1eb5644f68522d1a298942459.exe	afa887c1eb5644f68522d1a298942459.exe
PID 2868 wrote to memory of 2672	2868	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2868 wrote to memory of 2672	2868	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2868 wrote to memory of 2672	2868	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2868 wrote to memory of 2672	2868	afa887c1eb5644f68522d1a298942459.exe	powershell.exe
PID 2868 wrote to memory of 2400	2868	afa887c1eb5644f68522d1a298942459.exe	cmd.exe
PID 2868 wrote to memory of 2400	2868	afa887c1eb5644f68522d1a298942459.exe	cmd.exe
PID 2868 wrote to memory of 2400	2868	afa887c1eb5644f68522d1a298942459.exe	cmd.exe
PID 2868 wrote to memory of 2400	2868	afa887c1eb5644f68522d1a298942459.exe	cmd.exe
PID 2868 wrote to memory of 2400	2868	afa887c1eb5644f68522d1a298942459.exe	cmd.exe
PID 2868 wrote to memory of 2400	2868	afa887c1eb5644f68522d1a298942459.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\afa887c1eb5644f68522d1a298942459.exe
"C:\Users\Admin\AppData\Local\Temp\afa887c1eb5644f68522d1a298942459.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588

C:\Users\Admin\AppData\Local\Temp\afa887c1eb5644f68522d1a298942459.exe
"C:\Users\Admin\AppData\Local\Temp\afa887c1eb5644f68522d1a298942459.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2868

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2672

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:2400

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Impair Defenses

2

T1562

Disable or Modify Tools

2

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize
7KB

MD5
1285ce36c4a5775ca51897a14a25cc60

SHA1
aedc45c88b1136b008cb6be4915b5bd2c17c3f85

SHA256
ef8a4a73f873cec9334535720f3dff71ce69351272f5c67471526ad5712ff8c7

SHA512
6af9cec18bad27728cd2a1f6d86a3f861873ffda1122a7a870c8b10b61968d6298191f728e4ef22c9d9e6ee059b1119b63ddb52859ca40a947b0fbdeac62fab3

Download Submit
memory/2192-1-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2192-2-0x0000000004CE0000-0x0000000004D20000-memory.dmp

Filesize
256KB

Download
memory/2192-3-0x0000000000210000-0x0000000000218000-memory.dmp

Filesize
32KB

Download
memory/2192-4-0x00000000003F0000-0x0000000000432000-memory.dmp

Filesize
264KB

Download
memory/2192-5-0x0000000000690000-0x00000000006B8000-memory.dmp

Filesize
160KB

Download
memory/2192-32-0x0000000074C10000-0x00000000752FE000-memory.dmp

Filesize
6.9MB

Download
memory/2192-0-0x0000000000F50000-0x0000000000F92000-memory.dmp

Filesize
264KB

Download
memory/2400-45-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2400-44-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/2588-9-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download
memory/2588-12-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download
memory/2588-10-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2588-11-0x0000000002710000-0x0000000002750000-memory.dmp

Filesize
256KB

Download
memory/2588-8-0x000000006FB90000-0x000000007013B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-39-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-40-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2672-49-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2672-43-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2672-42-0x0000000002400000-0x0000000002440000-memory.dmp

Filesize
256KB

Download
memory/2672-41-0x00000000743C0000-0x000000007496B000-memory.dmp

Filesize
5.7MB

Download
memory/2868-21-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-33-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-19-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-17-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-31-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-23-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-29-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2868-15-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-13-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-25-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2868-50-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads