warzonerat | ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4

General

Target

ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4.vbs
Size

804KB
MD5

6a3f1d0a26574f5c1e2d0118ae1ec4aa
SHA1

c2e31c5426f0cb98ab8f8cf2e9f3eec95366476c
SHA256

ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4
SHA512

49496b5d797700c638cf750eaa3ff6a8e54ec52e864a074f2bb31fbcf607d18f04169c16e058b18cfe09273a81e33e37112a0735ca1d042d62cfdaa54481f58e
SSDEEP

24576:pLybbSfsKK4LPzHYjtY5eDHex4AH0sTfaKJVmcO/dh5Z2xMsoqUaCSG:a

Score

10^/10

warzonerat discovery infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

193.161.193.99:43544

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 7 IoCs

rat

resource	yara_rule
behavioral1/memory/2868-20-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2868-17-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2868-15-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2868-14-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2868-13-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2868-12-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat
behavioral1/memory/2868-22-0x0000000000400000-0x000000000055A000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

pid	Process
2056	temp_file_rhjRS.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2056 set thread context of 2868	2056	temp_file_rhjRS.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2748	2868	WerFault.exe	32

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	temp_file_rhjRS.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 2056	2148	WScript.exe	31
PID 2148 wrote to memory of 2056	2148	WScript.exe	31
PID 2148 wrote to memory of 2056	2148	WScript.exe	31
PID 2148 wrote to memory of 2056	2148	WScript.exe	31
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2056 wrote to memory of 2868	2056	temp_file_rhjRS.exe	32
PID 2868 wrote to memory of 2748	2868	RegAsm.exe	33
PID 2868 wrote to memory of 2748	2868	RegAsm.exe	33
PID 2868 wrote to memory of 2748	2868	RegAsm.exe	33
PID 2868 wrote to memory of 2748	2868	RegAsm.exe	33

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\ec97fe2ca09d875ceab1a42580d4817aad2a6ecfea52586454cbc782fb74d5e4.vbs"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\temp_file_rhjRS.exe
  "C:\Users\Admin\AppData\Local\Temp\temp_file_rhjRS.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2056
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2868
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2868 -s 292
      4⤵
      Program crash
      PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\temp_file_rhjRS.exe

Filesize
373KB

MD5
fecddc53aa8d346ffcd2152f87b39662

SHA1
ea706c10d4aab32962cbe6e0b4477456c357ad8a

SHA256
d6057ee110b35abbbb7c1869ed8965b3f82d63824c5de79509a737f4a456e212

SHA512
f6b1e984bd17c2176ce9b66ba50650a07940a36a40ff6bd27053fa6b07c16d7788feb857a48c7645df1d89d7f85851dea80fdf2fc7fc8374d9473ea9b68faa8f

Download Submit
memory/2056-18-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2056-6-0x000000007440E000-0x000000007440F000-memory.dmp

Filesize
4KB

Download
memory/2056-7-0x00000000002D0000-0x0000000000334000-memory.dmp

Filesize
400KB

Download
memory/2056-8-0x0000000074400000-0x0000000074AEE000-memory.dmp

Filesize
6.9MB

Download
memory/2868-17-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2868-20-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-10-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-15-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-14-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-13-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-12-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-11-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-9-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download
memory/2868-22-0x0000000000400000-0x000000000055A000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing