Analysis
-
max time kernel
14s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
27-10-2024 18:42
Static task
static1
Behavioral task
behavioral1
Sample
WarzoneRAT.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
WarzoneRAT.exe
Resource
win10v2004-20241007-en
General
-
Target
WarzoneRAT.exe
-
Size
321KB
-
MD5
600e0dbaefc03f7bf50abb0def3fb465
-
SHA1
1b5f0ac48e06edc4ed8243be61d71077f770f2b4
-
SHA256
61e6a93f43049712b5f2d949fd233fa8015fe4bef01b9e1285d3d87b12f894f2
-
SHA512
151eebac8f8f6e72d130114f030f048dff5bce0f99ff8d3a22e8fed7616155b3e87d29acf79f488d6b53ed2c5c9b05b57f76f1f91a568c21fe9bca228efb23d9
-
SSDEEP
6144:62GhN2db088fTdUuNU0we+HPps1zcJLVPzGKfwQ7PHC3NJTyhtPB1m:62iNG088fTWsU0wJBsGJPf4Q7PHC3NJ8
Malware Config
Extracted
warzonerat
168.61.222.215:5400
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
ReZer0 packer 1 IoCs
Detects ReZer0, a packer with multiple versions used in various campaigns.
resource yara_rule behavioral1/memory/1048-4-0x0000000000B90000-0x0000000000BB8000-memory.dmp rezer0 -
Warzone RAT payload 6 IoCs
resource yara_rule behavioral1/memory/2468-21-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2468-18-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2468-16-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2468-14-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2468-13-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat behavioral1/memory/2468-23-0x0000000000400000-0x0000000000553000-memory.dmp warzonerat -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1048 set thread context of 2468 1048 WarzoneRAT.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2856 2468 WerFault.exe 32 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WarzoneRAT.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1040 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1048 WarzoneRAT.exe 1048 WarzoneRAT.exe 1048 WarzoneRAT.exe 1048 WarzoneRAT.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1048 WarzoneRAT.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1048 wrote to memory of 1040 1048 WarzoneRAT.exe 29 PID 1048 wrote to memory of 1040 1048 WarzoneRAT.exe 29 PID 1048 wrote to memory of 1040 1048 WarzoneRAT.exe 29 PID 1048 wrote to memory of 1040 1048 WarzoneRAT.exe 29 PID 1048 wrote to memory of 2724 1048 WarzoneRAT.exe 31 PID 1048 wrote to memory of 2724 1048 WarzoneRAT.exe 31 PID 1048 wrote to memory of 2724 1048 WarzoneRAT.exe 31 PID 1048 wrote to memory of 2724 1048 WarzoneRAT.exe 31 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 1048 wrote to memory of 2468 1048 WarzoneRAT.exe 32 PID 2468 wrote to memory of 2856 2468 MSBuild.exe 33 PID 2468 wrote to memory of 2856 2468 MSBuild.exe 33 PID 2468 wrote to memory of 2856 2468 MSBuild.exe 33 PID 2468 wrote to memory of 2856 2468 MSBuild.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"C:\Users\Admin\AppData\Local\Temp\WarzoneRAT.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1048 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jFvfxe" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC83F.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1040
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵PID:2724
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2468 -s 2003⤵
- Program crash
PID:2856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bfe240d2fa579c18b942cf132c8c58c1
SHA1df4443b825923928c6fb3ff82df182054a34d210
SHA2566a29c49987698b0732d807c69918bbbda9c0855e98dfce7674be52ab61d14dd0
SHA512c947a39416c927289aac3806c4f136e24e481897f02368fc39d9cc5a4e9ca2b16e342a5c56dfd3f5a46e641534d7b2c96c9d412b18b5a56ddee1f5d4aed3ff51