warzonerat | c9f708d196905d6b42dda2b45f3a3965517d5cdc885f7b3b8824aaed33da5fff

General

Target

d02e7036dcce34d85849df93ec36c62f.exe
Size

236KB
MD5

d02e7036dcce34d85849df93ec36c62f
SHA1

211c57f2f2e2f3cf11ce59f6848d8c7cce41fd18
SHA256

c9f708d196905d6b42dda2b45f3a3965517d5cdc885f7b3b8824aaed33da5fff
SHA512

8807912b873d950e37504a845e0c198e468fd4eb454d97ed877ed648ac8bb80c9c41b0bc3ae95100ecc210c2473cdd1d07d86a75acfce440e79c7c95c48ba12f
SSDEEP

3072:ASWUYAlmXkJr4Dul8kZyLA93qlUD2mvwV6bFcHSRoodGv8Z36CxVYwwBJ785v7Wt:AEsBi17NCFYp3rtHmqbK65o

Score

10^/10

warzonerat evasion infostealer rat rezer0 trojan

Malware Config

Extracted

Family

warzonerat

C2

185.140.53.41:2104

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Windows Service

T1543.003

Disable or Modify Tools

T1562.001

Processes:

d02e7036dcce34d85849df93ec36c62f.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1"	d02e7036dcce34d85849df93ec36c62f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1"	d02e7036dcce34d85849df93ec36c62f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1"	d02e7036dcce34d85849df93ec36c62f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	d02e7036dcce34d85849df93ec36c62f.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ReZer0 packer 1 IoCs

Detects ReZer0, a packer with multiple versions used in various campaigns.

rezer0

Processes:

resource	yara_rule
behavioral1/memory/2760-5-0x0000000000A30000-0x0000000000A58000-memory.dmp	rezer0

Warzone RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2544-15-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2544-16-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2544-17-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2544-18-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2544-21-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2544-24-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2544-25-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat
behavioral1/memory/2544-41-0x0000000000400000-0x0000000000551000-memory.dmp	warzonerat

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

Processes:

d02e7036dcce34d85849df93ec36c62f.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features	d02e7036dcce34d85849df93ec36c62f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	d02e7036dcce34d85849df93ec36c62f.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

d02e7036dcce34d85849df93ec36c62f.exe

description pid process target process

PID 2760 set thread context of 2544 2760 d02e7036dcce34d85849df93ec36c62f.exe d02e7036dcce34d85849df93ec36c62f.exe
Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

powershell.exed02e7036dcce34d85849df93ec36c62f.exepowershell.exe

pid process

2592 powershell.exe
2760 d02e7036dcce34d85849df93ec36c62f.exe
2408 powershell.exe

description	pid	process	target process
PID 2760 set thread context of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe

pid	process
2592	powershell.exe
2760	d02e7036dcce34d85849df93ec36c62f.exe
2408	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exed02e7036dcce34d85849df93ec36c62f.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2592	powershell.exe
Token: SeDebugPrivilege	2760	d02e7036dcce34d85849df93ec36c62f.exe
Token: SeDebugPrivilege	2408	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

d02e7036dcce34d85849df93ec36c62f.exed02e7036dcce34d85849df93ec36c62f.exe

description	pid	process	target process
PID 2760 wrote to memory of 2592	2760	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2760 wrote to memory of 2592	2760	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2760 wrote to memory of 2592	2760	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2760 wrote to memory of 2592	2760	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2760 wrote to memory of 2544	2760	d02e7036dcce34d85849df93ec36c62f.exe	d02e7036dcce34d85849df93ec36c62f.exe
PID 2544 wrote to memory of 2408	2544	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2544 wrote to memory of 2408	2544	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2544 wrote to memory of 2408	2544	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2544 wrote to memory of 2408	2544	d02e7036dcce34d85849df93ec36c62f.exe	powershell.exe
PID 2544 wrote to memory of 2444	2544	d02e7036dcce34d85849df93ec36c62f.exe	cmd.exe
PID 2544 wrote to memory of 2444	2544	d02e7036dcce34d85849df93ec36c62f.exe	cmd.exe
PID 2544 wrote to memory of 2444	2544	d02e7036dcce34d85849df93ec36c62f.exe	cmd.exe
PID 2544 wrote to memory of 2444	2544	d02e7036dcce34d85849df93ec36c62f.exe	cmd.exe
PID 2544 wrote to memory of 2444	2544	d02e7036dcce34d85849df93ec36c62f.exe	cmd.exe
PID 2544 wrote to memory of 2444	2544	d02e7036dcce34d85849df93ec36c62f.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\d02e7036dcce34d85849df93ec36c62f.exe
"C:\Users\Admin\AppData\Local\Temp\d02e7036dcce34d85849df93ec36c62f.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2760

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-MpPreference -verbose
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592

C:\Users\Admin\AppData\Local\Temp\d02e7036dcce34d85849df93ec36c62f.exe
"C:\Users\Admin\AppData\Local\Temp\d02e7036dcce34d85849df93ec36c62f.exe"
2⤵
- Suspicious use of WriteProcessMemory
PID:2544

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
powershell Add-MpPreference -ExclusionPath C:\
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2408

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe"
3⤵
PID:2444

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

2

T1112

Impair Defenses

2

T1562

Disable or Modify Tools

2

T1562.001

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\V94TO9WRIH5I9HNSAU80.temp
Filesize
7KB

MD5
4a99cb311e86bcc6c670fc988739b4b9

SHA1
a51b700cf43771bdc2eaab8b8764bbd7878b116f

SHA256
90b79c07da7067c26862b15e0694e8cd86488182f33b504b0f866090e4a2edef

SHA512
13e0872f58293799f06658d6bbd3a845256bcec01df4bb47f7efdc59637764a5c665bf3526e9c04cc3debbdb3e49db38c7b7af60e26a27171c6b133d9b14f331

Download Submit
memory/2408-40-0x0000000073C60000-0x000000007420B000-memory.dmp

Filesize
5.7MB

Download
memory/2408-33-0x0000000002770000-0x00000000027B0000-memory.dmp

Filesize
256KB

Download
memory/2408-32-0x0000000073C60000-0x000000007420B000-memory.dmp

Filesize
5.7MB

Download
memory/2408-31-0x0000000073C60000-0x000000007420B000-memory.dmp

Filesize
5.7MB

Download
memory/2444-36-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2444-34-0x0000000000120000-0x0000000000121000-memory.dmp

Filesize
4KB

Download
memory/2544-25-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-21-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-41-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-12-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-13-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-14-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-15-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-16-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-17-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-18-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2544-19-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2544-24-0x0000000000400000-0x0000000000551000-memory.dmp

Filesize
1.3MB

Download
memory/2592-9-0x000000006F430000-0x000000006F9DB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-10-0x0000000002650000-0x0000000002690000-memory.dmp

Filesize
256KB

Download
memory/2592-8-0x000000006F430000-0x000000006F9DB000-memory.dmp

Filesize
5.7MB

Download
memory/2592-11-0x000000006F430000-0x000000006F9DB000-memory.dmp

Filesize
5.7MB

Download
memory/2760-23-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/2760-0-0x0000000000BC0000-0x0000000000C02000-memory.dmp

Filesize
264KB

Download
memory/2760-5-0x0000000000A30000-0x0000000000A58000-memory.dmp

Filesize
160KB

Download
memory/2760-4-0x0000000000500000-0x0000000000542000-memory.dmp

Filesize
264KB

Download
memory/2760-3-0x00000000004D0000-0x00000000004D8000-memory.dmp

Filesize
32KB

Download
memory/2760-2-0x0000000004C60000-0x0000000004CA0000-memory.dmp

Filesize
256KB

Download
memory/2760-1-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads