warzonerat | 6f35ab9d6aed8b8df1754149da79be5cdadae7b5366e8f2be46d9370f7e920c0

Analysis

max time kernel
146s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2024 19:04

Target

Server_lolllllllllllllllllll_kkkkkkkkkookkkkkkkkkkk_2345678980.ps1
Size

306KB
MD5

34446cf1dce57c6bbf4f44aa5d3675fb
SHA1

b4efe197fbcbe28beda44ede2ef8516ed951a0c9
SHA256

0f93f99cacceffa66e7b39641991bc99b4cbe5aac7b63f4cd21f55147a55971a
SHA512

d198f6cf552c4333ac255de119e4bea111d759c030b9da3a52700cc0a91cdcc122c70fe21ce068a137ff5bc40a42b99437c522ac473b2a6c0d45f85f31c03a31
SSDEEP

6144:p1V/V9xOh9RfHD60Q/i0RB9cthBjDOaqIQrIcGPnY1muAirbd:p1V/xONW/iHyj

Score

10^/10

Family

warzonerat

103.147.184.73:5719

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
behavioral30/memory/2084-14-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral30/memory/2084-18-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral30/memory/2084-20-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral30/memory/2084-21-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

powershell.exe

description pid process target process

PID 1188 set thread context of 2084 1188 powershell.exe aspnet_compiler.exe
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1188 powershell.exe
1188 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1188 powershell.exe

description	pid	process	target process
PID 1188 set thread context of 2084	1188	powershell.exe	aspnet_compiler.exe

pid	process
1188	powershell.exe
1188	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1188	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

Processes:

powershell.exe

description	pid	process	target process
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe
PID 1188 wrote to memory of 2084	1188	powershell.exe	aspnet_compiler.exe

C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
2⤵
PID:2084

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pkd142d4.asr.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1188-5-0x000001B208F50000-0x000001B208F72000-memory.dmp

Filesize
136KB

Download
memory/1188-10-0x000001B208F80000-0x000001B208F96000-memory.dmp

Filesize
88KB

Download
memory/1188-11-0x00007FFCC8540000-0x00007FFCC9001000-memory.dmp

Filesize
10.8MB

Download
memory/1188-12-0x000001B208D90000-0x000001B208DA0000-memory.dmp

Filesize
64KB

Download
memory/1188-13-0x000001B208D90000-0x000001B208DA0000-memory.dmp

Filesize
64KB

Download
memory/1188-19-0x00007FFCC8540000-0x00007FFCC9001000-memory.dmp

Filesize
10.8MB

Download
memory/2084-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2084-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2084-20-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2084-21-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download