warzonerat | c9df285477a2a0ef5ea934a5c3b0f94983e202aa82460e900fa203292ccab0b6

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
26-05-2024 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
Size

1.1MB
MD5

07a2fb20a014cd15f034a5ddd37fafd0
SHA1

28c9cc9c5a2126294746ca62e7302cbfe021544c
SHA256

c9df285477a2a0ef5ea934a5c3b0f94983e202aa82460e900fa203292ccab0b6
SHA512

89ccc247b401e0282842c9c76f2c37b60e343ecacdfc3d58cfd4b613500a49f1794e0a091120fd9e8050dc794e9ae616e62d5228d30a4f91c2bf2987b0413039
SSDEEP

24576:4mtwzzxFGaZtqS2xS65L36YPxpPj5LzXqliOzR:4mePxDqS2EvYPxp5Lzui

Score

10^/10

warzonerat execution infostealer rat

Malware Config

Extracted

Family

warzonerat

thebeast415.duckdns.org:4036

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 6 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2644-92-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2644-91-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2644-88-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2644-86-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2644-84-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2644-82-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
execution

PowerShell
T1059.001

Processes:

powershell.exepowershell.exe

pid process

1516 powershell.exe
2764 powershell.exe

pid	process
1516	powershell.exe
2764	powershell.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe

description	pid	process	target process
PID 2228 set thread context of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 set thread context of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1076 schtasks.exe
2756 schtasks.exe

pid	process
1076	schtasks.exe
2756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exepowershell.exepowershell.exe

pid	process
2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
2764	powershell.exe
2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
1516	powershell.exe
2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
Token: SeDebugPrivilege	2764	powershell.exe
Token: SeDebugPrivilege	1516	powershell.exe

Suspicious use of WriteProcessMemory 37 IoCs

Processes:

07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe

description	pid	process	target process
PID 2228 wrote to memory of 2764	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2228 wrote to memory of 2764	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2228 wrote to memory of 2764	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2228 wrote to memory of 2764	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2228 wrote to memory of 2756	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2228 wrote to memory of 2756	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2228 wrote to memory of 2756	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2228 wrote to memory of 2756	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2228 wrote to memory of 2692	2228	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 1516	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2692 wrote to memory of 1516	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2692 wrote to memory of 1516	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2692 wrote to memory of 1516	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	powershell.exe
PID 2692 wrote to memory of 1076	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2692 wrote to memory of 1076	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2692 wrote to memory of 1076	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2692 wrote to memory of 1076	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	schtasks.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
PID 2692 wrote to memory of 2644	2692	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe	07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe

C:\Users\Admin\AppData\Local\Temp\07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2228

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sdvtqmSny.exe"
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2764

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sdvtqmSny" /XML "C:\Users\Admin\AppData\Local\Temp\tmp59D3.tmp"
2⤵
- Creates scheduled task(s)
PID:2756

C:\Users\Admin\AppData\Local\Temp\07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qlFNePdSzRL.exe"
3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qlFNePdSzRL" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAB3D.tmp"
3⤵
- Creates scheduled task(s)
PID:1076

C:\Users\Admin\AppData\Local\Temp\07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\07a2fb20a014cd15f034a5ddd37fafd0_NeikiAnalytics.exe"
3⤵
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp59D3.tmp

Filesize
1KB

MD5
9a32e8dd09fc64b9a344e9f261cf8a76

SHA1
25fff01af4a1b2a811cf3e50d827c5f67f76497f

SHA256
50db518745a1178ef73d7a1efaaf734f8adbf76fa72e41c870e7f6ad24ac086f

SHA512
ed859d9eca19c866e7643c84848da65f5291de5755a16ba81c2016f47941bbce7f8cc0d3029fd5e185e36caa46f906f096acd26d272d4dbeecc3420b4c67ad56

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpAB3D.tmp

Filesize
1KB

MD5
1a7a9506b474b5b774a69d9b353c9bb0

SHA1
317e612808cf9ab890a9d080786b2dca39352adc

SHA256
7c77b6069d610e3359716b9e77ed254d77fa1917ba7b7506ae9a48149767fc8c

SHA512
daaeb83bd53dfee03ed38149ae67820dc30e3f4b32e13998b58d90cc010d5a1da7e1ac039c9518668c79c9df7603cda9d68a02222a703bd43561fbb8b64ad471

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
ed583117e83794a40785c9e1d8d6a43e

SHA1
a245fe716cb8d8814cfd0ca3941a8c763608b048

SHA256
0050b001909de4bdade92cca573749390465ef1f4995b1b00c0470e0c05e6cce

SHA512
cb13f8a3f33f294deddc2ca10ad3b094531136ede0228fcf7393c6df3905f20d6ceda6cde31e135902fce60db2097673a438c5f05bdae6306e35f15f771f6d6a

Download Submit
C:\Users\Admin\AppData\Roaming\qlFNePdSzRL.exe

Filesize
1.1MB

MD5
07a2fb20a014cd15f034a5ddd37fafd0

SHA1
28c9cc9c5a2126294746ca62e7302cbfe021544c

SHA256
c9df285477a2a0ef5ea934a5c3b0f94983e202aa82460e900fa203292ccab0b6

SHA512
89ccc247b401e0282842c9c76f2c37b60e343ecacdfc3d58cfd4b613500a49f1794e0a091120fd9e8050dc794e9ae616e62d5228d30a4f91c2bf2987b0413039

Download Submit
memory/2228-0-0x0000000074B1E000-0x0000000074B1F000-memory.dmp

Filesize
4KB

Download
memory/2228-1-0x0000000001320000-0x0000000001442000-memory.dmp

Filesize
1.1MB

Download
memory/2228-2-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2228-3-0x0000000000430000-0x0000000000444000-memory.dmp

Filesize
80KB

Download
memory/2228-4-0x0000000000460000-0x0000000000468000-memory.dmp

Filesize
32KB

Download
memory/2228-5-0x0000000000780000-0x000000000078C000-memory.dmp

Filesize
48KB

Download
memory/2228-6-0x0000000005040000-0x000000000512E000-memory.dmp

Filesize
952KB

Download
memory/2228-40-0x0000000074B10000-0x00000000751FE000-memory.dmp

Filesize
6.9MB

Download
memory/2644-76-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-78-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-80-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-82-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-84-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-86-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-88-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-91-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-92-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2692-53-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-31-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-60-0x00000000007C0000-0x00000000007E0000-memory.dmp

Filesize
128KB

Download
memory/2692-57-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-56-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-59-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-52-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-50-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-47-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-46-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-44-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-43-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-41-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-37-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-36-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-34-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-32-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-61-0x00000000007E0000-0x00000000007EA000-memory.dmp

Filesize
40KB

Download
memory/2692-30-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-29-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-28-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-27-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-49-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-12-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-14-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-16-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-18-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-22-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-24-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-21-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-20-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2692-26-0x0000000000400000-0x00000000004B4000-memory.dmp

Filesize
720KB

Download
memory/2692-64-0x00000000007F0000-0x00000000007FE000-memory.dmp

Filesize
56KB

Download
memory/2692-65-0x0000000000E20000-0x0000000000E7C000-memory.dmp

Filesize
368KB

Download