warzonerat | 61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2

General

Target

WarzoneRAT.exe
Size

321KB
MD5

600e0dbaefc03f7bf50abb0def3fb465
SHA1

1b5f0ac48e06edc4ed8243be61d71077f770f2b4
SHA256

61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2
SHA512

151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9
SSDEEP

6144:62GhN2db088fTdUuNU0we+HPps1zcJLVPzGKfwQ7PHC3NJTyhtPB1m:62iNG088fTWsU0wJBsGJPf4Q7PHC3NJ8

Score

10^/10

warzonerat infostealer rat rezer0

Malware Config

Extracted

Family

warzonerat

C2

168.61.222.215:5400

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2228-4-0x0000000004790000-0x00000000047B8000-memory.dmp	rezer0

Warzone RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2984-16-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2984-18-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2984-19-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2984-20-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2984-22-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2984-24-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2984-26-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat
behavioral1/memory/2984-34-0x0000000000400000-0x0000000000553000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

WarzoneRAT.exe

description pid process target process

PID 2228 set thread context of 2984 2228 WarzoneRAT.exe MSBuild.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exe

pid process

2600 schtasks.exe

description	pid	process	target process
PID 2228 set thread context of 2984	2228	WarzoneRAT.exe	MSBuild.exe

pid	process
2600	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 28 IoCs

adware spyware

Modify Registry

T1112

Processes:

IEXPLORE.EXEIEXPLORE.EXE

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Zoom	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D5FC6413-D813-11EE-8119-4A4F109F65B0}.dat = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{D5FC6411-D813-11EE-8119-4A4F109F65B0} = "0"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IntelliForms	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\LowRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\PageSetup	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\InternetRegistry	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\MINIE	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\IETld\LowMic	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	IEXPLORE.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

WarzoneRAT.exe

pid process

2228 WarzoneRAT.exe
2228 WarzoneRAT.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

WarzoneRAT.exe

description pid process

Token: SeDebugPrivilege 2228 WarzoneRAT.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

IEXPLORE.EXE

pid process

2756 IEXPLORE.EXE
Suspicious use of SetWindowsHookEx 4 IoCs

Processes:

IEXPLORE.EXEIEXPLORE.EXE

pid process

2756 IEXPLORE.EXE
2756 IEXPLORE.EXE
2060 IEXPLORE.EXE
2060 IEXPLORE.EXE

pid	process
2228	WarzoneRAT.exe
2228	WarzoneRAT.exe

description	pid	process
Token: SeDebugPrivilege	2228	WarzoneRAT.exe

pid	process
2756	IEXPLORE.EXE

pid	process
2756	IEXPLORE.EXE
2756	IEXPLORE.EXE
2060	IEXPLORE.EXE
2060	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

WarzoneRAT.exeiexplore.exeIEXPLORE.EXE

description	pid	process	target process
PID 2228 wrote to memory of 2600	2228	WarzoneRAT.exe	schtasks.exe
PID 2228 wrote to memory of 2600	2228	WarzoneRAT.exe	schtasks.exe
PID 2228 wrote to memory of 2600	2228	WarzoneRAT.exe	schtasks.exe
PID 2228 wrote to memory of 2600	2228	WarzoneRAT.exe	schtasks.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2228 wrote to memory of 2984	2228	WarzoneRAT.exe	MSBuild.exe
PID 2728 wrote to memory of 2756	2728	iexplore.exe	IEXPLORE.EXE
PID 2728 wrote to memory of 2756	2728	iexplore.exe	IEXPLORE.EXE
PID 2728 wrote to memory of 2756	2728	iexplore.exe	IEXPLORE.EXE
PID 2728 wrote to memory of 2756	2728	iexplore.exe	IEXPLORE.EXE
PID 2756 wrote to memory of 2060	2756	IEXPLORE.EXE	IEXPLORE.EXE
PID 2756 wrote to memory of 2060	2756	IEXPLORE.EXE	IEXPLORE.EXE
PID 2756 wrote to memory of 2060	2756	IEXPLORE.EXE	IEXPLORE.EXE
PID 2756 wrote to memory of 2060	2756	IEXPLORE.EXE	IEXPLORE.EXE

C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe
"C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp5DC9.tmp"
2⤵
- Creates scheduled task(s)
PID:2600

C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
2⤵
PID:2984

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:2452

C:\Program Files (x86)\Internet Explorer\iexplore.exe
"C:\Program Files (x86)\Internet Explorer\iexplore.exe" -nohome
1⤵
- Suspicious use of WriteProcessMemory
PID:2728

C:\Program Files\Internet Explorer\IEXPLORE.EXE
"C:\Program Files\Internet Explorer\IEXPLORE.EXE" -nohome
2⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2756

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2756 CREDAT:275457 /prefetch:2
3⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2060

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1

T1053

Persistence

Scheduled Task/Job

1

T1053

Privilege Escalation

Scheduled Task/Job

1

T1053

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp5DC9.tmp
Filesize
1KB

MD5
e883f046e20bdd76acafa2fab928b09c

SHA1
0f68af7e1aae50f0b6ae900d7a4e3cbedb397cfa

SHA256
058c0cdb49d62c7ea5ebcbcc747ffcd26332aff744d66076bdd0498845a64dcf

SHA512
af17542b2fac85887ac20cda2d8c9223e675a63a525600b9f227ccbf06850a453a7720f36c12a5b45e9b99ec2c8982eec7d5739f25a8ea9555dcd67234666ae7

Download Submit
memory/2228-0-0x0000000000D90000-0x0000000000DE6000-memory.dmp

Filesize
344KB

Download
memory/2228-1-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2228-2-0x00000000048D0000-0x0000000004910000-memory.dmp

Filesize
256KB

Download
memory/2228-3-0x0000000000530000-0x0000000000538000-memory.dmp

Filesize
32KB

Download
memory/2228-4-0x0000000004790000-0x00000000047B8000-memory.dmp

Filesize
160KB

Download
memory/2228-25-0x0000000073F60000-0x000000007464E000-memory.dmp

Filesize
6.9MB

Download
memory/2984-14-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-12-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-16-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-18-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-19-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-20-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-21-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2984-22-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-10-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-24-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-26-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download
memory/2984-34-0x0000000000400000-0x0000000000553000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads