warzonerat | f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880

Analysis

max time kernel
95s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19-11-2024 09:56

Target

f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe
Size

141KB
MD5

2222f3cf1ac5436b12b51706c497d3ef
SHA1

fc529d33fae16b37d00f7b39b40c5d6a722d6065
SHA256

f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880
SHA512

7fecf6b81bf1bc4733218b62d864417ad00234d0aaa95811507d0067367026f455af1b47461b72150faeb42a2c9df92340e62f3f7535dc3f2146d6aac9e46271
SSDEEP

3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Adds Run key to start application 2 TTPs 1 IoCs

Registry Run Keys / Startup Folder

Modify Registry

Processes:

f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe"	f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

System Language Discovery

Processes:

f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe

description	pid	process	target process
PID 4240 wrote to memory of 1124	4240	f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe	cmd.exe
PID 4240 wrote to memory of 1124	4240	f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe	cmd.exe
PID 4240 wrote to memory of 1124	4240	f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe	cmd.exe
PID 4240 wrote to memory of 1124	4240	f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe	cmd.exe
PID 4240 wrote to memory of 1124	4240	f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe
"C:\Users\Admin\AppData\Local\Temp\f3165a426e73b3dce639c5f44c0c6dca403a363fa07abf4458e61f7a61d7d880.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1124