warzonerat | ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4

General

Target

ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4.vbs
Size

804KB
MD5

6a3f1d0a26574f5c1e2d0118ae1ec4aa
SHA1

c2e31c5426f0cb98ab8f8cf2e9f3eec95366476c
SHA256

ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4
SHA512

49496b5d797700c638cf750eaa3ff6a8e54ec52e864a074f2bb31fbcf607d18f04169c16e058b18cfe09273a81e33e37112a0735ca1d042d62cfdaa54481f58e
SSDEEP

24576:pLybbSfsKK4LPzHYjtY5eDHex4AH0sTfaKJVmcO/dh5Z2xMsoqUaCSG:a

Score

10^/10

warzonerat discovery infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

193.161.193.99:43544

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4452-14-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/4452-18-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/4452-20-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral2/memory/4452-21-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
4356	temp_file_rhjRS.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4356 set thread context of 4452	4356	temp_file_rhjRS.exe	98

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp_file_rhjRS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	temp_file_rhjRS.exe
4356	temp_file_rhjRS.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4356	temp_file_rhjRS.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 4356	1840	WScript.exe	94
PID 1840 wrote to memory of 4356	1840	WScript.exe	94
PID 1840 wrote to memory of 4356	1840	WScript.exe	94
PID 4356 wrote to memory of 4324	4356	temp_file_rhjRS.exe	97
PID 4356 wrote to memory of 4324	4356	temp_file_rhjRS.exe	97
PID 4356 wrote to memory of 4324	4356	temp_file_rhjRS.exe	97
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98
PID 4356 wrote to memory of 4452	4356	temp_file_rhjRS.exe	98

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\temp_file_rhjRS.exe
  "C:\Users\Admin\AppData\Local\Temp\temp_file_rhjRS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4356
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    PID:4324
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp_file_rhjRS.exe

Filesize
373KB

MD5
fecddc53aa8d346ffcd2152f87b39662

SHA1
ea706c10d4aab32962cbe6e0b4477456c357ad8a

SHA256
d6057ee110b35abbbb7c1869ed8965b3f82d63824c5de79509a737f4a456e212

SHA512
f6b1e984bd17c2176ce9b66ba50650a07940a36a40ff6bd27053fa6b07c16d7788feb857a48c7645df1d89d7f85851dea80fdf2fc7fc8374d9473ea9b68faa8f

Download Submit
memory/4356-11-0x00000000746DE000-0x00000000746DF000-memory.dmp

Filesize
4KB

Download
memory/4356-12-0x0000000000BC0000-0x0000000000C24000-memory.dmp

Filesize
400KB

Download
memory/4356-13-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/4356-17-0x00000000746D0000-0x0000000074E80000-memory.dmp

Filesize
7.7MB

Download
memory/4452-14-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/4452-18-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/4452-20-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/4452-21-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing