warzonerat | 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6

Resubmissions

09/04/2024, 10:11

240409-l75m8scd589

09/04/2024, 10:09

09/04/2024, 10:09

09/04/2024, 10:09

13/03/2024, 02:34

Analysis

max time kernel
147s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
Size 39KB
Sample240313-c2ncbsce29
SHA256 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6
MD5 3a3752bfa76ae16628e03d4a00b3e1c9
SHA1 d5194572e7781aa893f84e59046bcc286d76ee62
SHA512 0871580c12e9d941a152c9ec0124aae2a3f072484baf050d85a49bfd1147d8c151965c3f9779be6182fae218b0e1786b8c82cb90b29e5c88014ca8a9bcd01018
SSDEEP 768:Qnbsx4iDVJLU0DA6Xlnw0ei1s8jdj6yV5SNUI:sbsx4oVjXC0ei1s8j6yaNJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat discovery infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

zakriexports.com:2017

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Contacts a large (4661) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs

resource	yara_rule
behavioral2/memory/2276-23-0x0000000000400000-0x000000000055A000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs

resource	yara_rule
behavioral2/memory/2276-23-0x0000000000400000-0x000000000055A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Detects executables embedding command execution via IExecuteCommand COM object 1 IoCs

resource	yara_rule
behavioral2/memory/2276-23-0x0000000000400000-0x000000000055A000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_IExecuteCommandCOM

Detects executables packed with or use KoiVM 1 IoCs

resource	yara_rule
behavioral2/memory/3012-10-0x00000286F33B0000-0x00000286F342C000-memory.dmp	INDICATOR_EXE_Packed_KoiVM

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/2276-23-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe

Executes dropped EXE 1 IoCs

pid	Process
13796	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 13796 set thread context of 2276	13796	svchost.exe	119

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
6548	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
13536	timeout.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
Token: SeDebugPrivilege	13796	svchost.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 12960	3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe	100
PID 3012 wrote to memory of 12960	3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe	100
PID 3012 wrote to memory of 13020	3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe	101
PID 3012 wrote to memory of 13020	3012	9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe	101
PID 12960 wrote to memory of 6548	12960	cmd.exe	104
PID 12960 wrote to memory of 6548	12960	cmd.exe	104
PID 13020 wrote to memory of 13536	13020	cmd.exe	105
PID 13020 wrote to memory of 13536	13020	cmd.exe	105
PID 13020 wrote to memory of 13796	13020	cmd.exe	106
PID 13020 wrote to memory of 13796	13020	cmd.exe	106
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 23744	13796	svchost.exe	114
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 4708	13796	svchost.exe	117
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 26120	13796	svchost.exe	118
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 2276	13796	svchost.exe	119
PID 13796 wrote to memory of 25924	13796	svchost.exe	120
PID 13796 wrote to memory of 25924	13796	svchost.exe	120
PID 13796 wrote to memory of 25924	13796	svchost.exe	120
PID 2276 wrote to memory of 14684	2276	iexplore.exe	124
PID 2276 wrote to memory of 14684	2276	iexplore.exe	124
PID 2276 wrote to memory of 14684	2276	iexplore.exe	124
PID 2276 wrote to memory of 14684	2276	iexplore.exe	124
PID 2276 wrote to memory of 14684	2276	iexplore.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe
"C:\Users\Admin\AppData\Local\Temp\9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:12960
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:6548
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpEBD7.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:13020
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:13536
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:13796
  - - C:\Windows\System32\calc.exe
      "C:\Windows\System32\calc.exe"
      4⤵
      PID:23744
  - - C:\Windows\System32\notepad.exe
      "C:\Windows\System32\notepad.exe"
      4⤵
      PID:4708
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe"
      4⤵
      PID:26120
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2276
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        
        PID:14684
  - - C:\Program Files (x86)\Internet Explorer\iexplore.exe
      "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
      4⤵
      PID:25924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpEBD7.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmpEBD7.tmp.bat
Size 151B
SHA256 bdef26277f90d7bc9bd6b6281f6488be947f992c3f84e81679564f2f49bff2b2
MD5 332a2edfbaddcb944c98e33083de0cb8
SHA1 b4fa0e4fe9e10cdc9cc7c43469ae4f312c2a1253
SHA512 bc7a9ed75786f4b2a2b10396b69345ae9e258dc3e6cdc01fe69ad199330a474ff3936964fefe833fd4c1b0d86e4989f8753d8ffba6d84fcbaade1ba8cf80d814
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 39KB
SHA256 9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6
MD5 3a3752bfa76ae16628e03d4a00b3e1c9
SHA1 d5194572e7781aa893f84e59046bcc286d76ee62
SHA512 0871580c12e9d941a152c9ec0124aae2a3f072484baf050d85a49bfd1147d8c151965c3f9779be6182fae218b0e1786b8c82cb90b29e5c88014ca8a9bcd01018
SSDEEP 768:Qnbsx4iDVJLU0DA6Xlnw0ei1s8jdj6yV5SNUI:sbsx4oVjXC0ei1s8j6yaNJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2276-23-0x0000000000400000-0x000000000055A000-memory.dmp

Download

memory/3012-9-0x00007FFE61070000-0x00007FFE61B31000-memory.dmp

Download

memory/3012-10-0x00000286F33B0000-0x00000286F342C000-memory.dmp

Download

memory/3012-11-0x00000286F28A0000-0x00000286F28B0000-memory.dmp

Download

memory/3012-0-0x00000286D8130000-0x00000286D813E000-memory.dmp

Download

memory/3012-17-0x00007FFE61070000-0x00007FFE61B31000-memory.dmp

Download

memory/3012-2-0x00000286F28A0000-0x00000286F28B0000-memory.dmp

Download

memory/3012-1-0x00007FFE61070000-0x00007FFE61B31000-memory.dmp

Download

memory/13796-21-0x00007FFE61070000-0x00007FFE61B31000-memory.dmp

Download

memory/13796-22-0x00007FFE61070000-0x00007FFE61B31000-memory.dmp

Download

memory/13796-26-0x00007FFE61070000-0x00007FFE61B31000-memory.dmp

Download

memory/14684-24-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download