warzonerat | bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe"	explorer.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	explorer.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

Processes:

resource	yara_rule
C:\Windows\system\explorer.exe	warzonerat
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	warzonerat
\Windows\system\spoolsv.exe	warzonerat
\Windows\system\svchost.exe	warzonerat

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

explorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR"	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}	explorer.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\system\explorer.exe	aspack_v212_v242
C:\Users\Admin\AppData\Local\Chrome\StikyNot.exe	aspack_v212_v242
\Windows\system\spoolsv.exe	aspack_v212_v242
\Windows\system\svchost.exe	aspack_v212_v242

Executes dropped EXE 10 IoCs

Processes:

explorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exespoolsv.exesvchost.exe

pid	process
2836	explorer.exe
1696	explorer.exe
2452	spoolsv.exe
2396	spoolsv.exe
1768	spoolsv.exe
3068	spoolsv.exe
920	spoolsv.exe
340	spoolsv.exe
2184	spoolsv.exe
1732	svchost.exe

Loads dropped DLL 52 IoCs

Processes:

bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exeexplorer.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exespoolsv.exespoolsv.exe

pid	process
2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
2788	WerFault.exe
2788	WerFault.exe
2788	WerFault.exe
2788	WerFault.exe
2788	WerFault.exe
2788	WerFault.exe
2788	WerFault.exe
1696	explorer.exe
1696	explorer.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1724	WerFault.exe
1696	explorer.exe
1696	explorer.exe
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe
624	WerFault.exe
1696	explorer.exe
1696	explorer.exe
2212	WerFault.exe
2212	WerFault.exe
2212	WerFault.exe
2212	WerFault.exe
2212	WerFault.exe
2212	WerFault.exe
2212	WerFault.exe
1696	explorer.exe
1696	explorer.exe
2972	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe
2972	WerFault.exe
2452	spoolsv.exe
2184	spoolsv.exe
2184	spoolsv.exe

Adds Run key to start application 2 TTPs 5 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

explorer.exespoolsv.exebda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exeexplorer.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO"	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	spoolsv.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe"	explorer.exe

Suspicious use of SetThreadContext 6 IoCs

Processes:

bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exeexplorer.exespoolsv.exe

description	pid	process	target process
PID 1876 set thread context of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 set thread context of 1588	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	diskperf.exe
PID 2836 set thread context of 1696	2836	explorer.exe	explorer.exe
PID 2836 set thread context of 852	2836	explorer.exe	diskperf.exe
PID 2452 set thread context of 2184	2452	spoolsv.exe	spoolsv.exe
PID 2452 set thread context of 2936	2452	spoolsv.exe	diskperf.exe

Drops file in Windows directory 5 IoCs

Processes:

bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exeexplorer.exespoolsv.exe

description	ioc	process
File opened for modification	\??\c:\windows\system\explorer.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
File opened for modification	\??\c:\windows\system\spoolsv.exe	explorer.exe
File opened for modification	\??\c:\windows\system\explorer.exe	explorer.exe
File opened for modification	\??\c:\windows\system\svchost.exe	spoolsv.exe
File opened for modification	C:\Windows\system\udsys.exe	explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 5 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process
2788	2396	WerFault.exe
1724	1768	WerFault.exe	spoolsv.exe
624	3068	WerFault.exe	spoolsv.exe
2212	920	WerFault.exe	spoolsv.exe
2972	340	WerFault.exe	spoolsv.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exeexplorer.exe

pid	process
2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

explorer.exe

pid process

1696 explorer.exe

pid	process
1696	explorer.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exeexplorer.exespoolsv.exe

pid	process
2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
1696	explorer.exe
2184	spoolsv.exe
2184	spoolsv.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exebda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exeexplorer.exeexplorer.exespoolsv.exespoolsv.exespoolsv.exe

description	pid	process	target process
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 2448	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
PID 1876 wrote to memory of 1588	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	diskperf.exe
PID 1876 wrote to memory of 1588	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	diskperf.exe
PID 1876 wrote to memory of 1588	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	diskperf.exe
PID 1876 wrote to memory of 1588	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	diskperf.exe
PID 1876 wrote to memory of 1588	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	diskperf.exe
PID 1876 wrote to memory of 1588	1876	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	diskperf.exe
PID 2448 wrote to memory of 2836	2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	explorer.exe
PID 2448 wrote to memory of 2836	2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	explorer.exe
PID 2448 wrote to memory of 2836	2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	explorer.exe
PID 2448 wrote to memory of 2836	2448	bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 1696	2836	explorer.exe	explorer.exe
PID 2836 wrote to memory of 852	2836	explorer.exe	diskperf.exe
PID 2836 wrote to memory of 852	2836	explorer.exe	diskperf.exe
PID 2836 wrote to memory of 852	2836	explorer.exe	diskperf.exe
PID 2836 wrote to memory of 852	2836	explorer.exe	diskperf.exe
PID 2836 wrote to memory of 852	2836	explorer.exe	diskperf.exe
PID 2836 wrote to memory of 852	2836	explorer.exe	diskperf.exe
PID 1696 wrote to memory of 2452	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 2452	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 2452	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 2452	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 2396	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 2396	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 2396	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 2396	1696	explorer.exe	spoolsv.exe
PID 2396 wrote to memory of 2788	2396	spoolsv.exe	WerFault.exe
PID 2396 wrote to memory of 2788	2396	spoolsv.exe	WerFault.exe
PID 2396 wrote to memory of 2788	2396	spoolsv.exe	WerFault.exe
PID 2396 wrote to memory of 2788	2396	spoolsv.exe	WerFault.exe
PID 1696 wrote to memory of 1768	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 1768	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 1768	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 1768	1696	explorer.exe	spoolsv.exe
PID 1768 wrote to memory of 1724	1768	spoolsv.exe	WerFault.exe
PID 1768 wrote to memory of 1724	1768	spoolsv.exe	WerFault.exe
PID 1768 wrote to memory of 1724	1768	spoolsv.exe	WerFault.exe
PID 1768 wrote to memory of 1724	1768	spoolsv.exe	WerFault.exe
PID 1696 wrote to memory of 3068	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 3068	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 3068	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 3068	1696	explorer.exe	spoolsv.exe
PID 3068 wrote to memory of 624	3068	spoolsv.exe	WerFault.exe
PID 3068 wrote to memory of 624	3068	spoolsv.exe	WerFault.exe
PID 3068 wrote to memory of 624	3068	spoolsv.exe	WerFault.exe
PID 3068 wrote to memory of 624	3068	spoolsv.exe	WerFault.exe
PID 1696 wrote to memory of 920	1696	explorer.exe	spoolsv.exe
PID 1696 wrote to memory of 920	1696	explorer.exe	spoolsv.exe

C:\Users\Admin\AppData\Local\Temp\bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
"C:\Users\Admin\AppData\Local\Temp\bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe"
1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1876

C:\Users\Admin\AppData\Local\Temp\bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe
"C:\Users\Admin\AppData\Local\Temp\bda87065f999abed40e1ae474c84e42904e8911e10812e8dd7b388947148c1a1.exe"
2⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2448

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2836

\??\c:\windows\system\explorer.exe
c:\windows\system\explorer.exe
4⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Modifies Installed Components in the registry
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1696

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:2452

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
6⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2184

\??\c:\windows\system\svchost.exe
c:\windows\system\svchost.exe
7⤵
- Executes dropped EXE
PID:1732

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
6⤵
PID:2936

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2396

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2396 -s 36
6⤵
- Loads dropped DLL
- Program crash
PID:2788

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1768 -s 36
6⤵
- Loads dropped DLL
- Program crash
PID:1724

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3068 -s 36
6⤵
- Loads dropped DLL
- Program crash
PID:624

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 920 -s 36
6⤵
- Loads dropped DLL
- Program crash
PID:2212

\??\c:\windows\system\spoolsv.exe
c:\windows\system\spoolsv.exe SE
5⤵
- Executes dropped EXE
PID:340

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 340 -s 36
6⤵
- Loads dropped DLL
- Program crash
PID:2972

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
4⤵
PID:852

C:\Windows\SysWOW64\diskperf.exe
"C:\Windows\SysWOW64\diskperf.exe"
2⤵
PID:1588

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3

T1547

Registry Run Keys / Startup Folder

2

Winlogon Helper DLL

T1547.004

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery