Process spawned unexpected child process

This typically indicates the parent process was compromised via an exploit or macro.

WarzoneRat, AveMaria

WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

suricata: ET MALWARE Possible Malicious Macro DL EXE Feb 2016

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Warzone RAT Payload

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE