warzonerat | 91292df65ea051a8cd7009382fb66c6b3fed39e8ddc3a27e38c990e2b69ea942

Analysis

max time kernel
148s
max time network
133s
platform
windows7_x64
resource
win7
submitted
14/10/2020, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Remittance.com.exe
Size 295KB
Sample201014-nz7qy5tg86
SHA256 91292df65ea051a8cd7009382fb66c6b3fed39e8ddc3a27e38c990e2b69ea942
MD5 12e50c4661d41f084dc01d04f54179bf
SHA1 9cfaff4c4798e97b134e281e3d1390f9e23a124b
SHA512 b4e4c27918487d7abdfc379d0aa91ac1021d9c72161e8b790ca144e970759081c1fa38a673afd8db0b5b2962264030e60d968a864b1371337c0966f683fefff8
MD5 SHA1 SHA512

Score

10^/10

rat persistence infostealer warzonerat spyware

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/904-16-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/904-17-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/904-19-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/1952-61-0x0000000000405CE2-mapping.dmp	warzonerat
behavioral1/memory/1952-63-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 6 IoCs

pid	Process
1960	Otuhgn.exe
904	Otuhgn.exe
592	intelgraphics.exe
568	Otuhgn.exe
1808	Otuhgn.exe
1952	Otuhgn.exe

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	Otuhgn.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	Otuhgn.exe

Loads dropped DLL 9 IoCs

pid	Process
1108	Remittance.com.exe
904	Otuhgn.exe
592	intelgraphics.exe
1952	Otuhgn.exe
1952	Otuhgn.exe
1952	Otuhgn.exe
1952	Otuhgn.exe
1952	Otuhgn.exe
1952	Otuhgn.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Wlbiha = "C:\\Users\\Admin\\Documents\\ebbbik\\Wlbiha.url"	Otuhgn.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\intelgraphics = "C:\\ProgramData\\intelgraphics.exe"	Otuhgn.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Wlbiha = "C:\\Users\\Admin\\Documents\\ebbbik\\Wlbiha.url"	Otuhgn.exe

JavaScript code in executable 1 IoCs

resource	yara_rule
behavioral1/files/0x00030000000131b5-76.dat	js

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1960 set thread context of 904	1960	Otuhgn.exe	30
PID 1960 set thread context of 2040	1960	Otuhgn.exe	29
PID 1808 set thread context of 1824	1808	Otuhgn.exe	34
PID 1808 set thread context of 1952	1808	Otuhgn.exe	35

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	Otuhgn.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1960	Otuhgn.exe
1960	Otuhgn.exe
1960	Otuhgn.exe
1960	Otuhgn.exe
2040	regasm.exe
2040	regasm.exe
1808	Otuhgn.exe
1808	Otuhgn.exe
1808	Otuhgn.exe
1808	Otuhgn.exe
1824	regasm.exe
1824	regasm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1960	Otuhgn.exe
Token: SeDebugPrivilege	2040	regasm.exe
Token: SeDebugPrivilege	1808	Otuhgn.exe
Token: SeDebugPrivilege	1824	regasm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1952	Otuhgn.exe

Suspicious use of WriteProcessMemory 70 IoCs

description	pid	Process	procid_target
PID 1108 wrote to memory of 1960	1108	Remittance.com.exe	28
PID 1108 wrote to memory of 1960	1108	Remittance.com.exe	28
PID 1108 wrote to memory of 1960	1108	Remittance.com.exe	28
PID 1108 wrote to memory of 1960	1108	Remittance.com.exe	28
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 904	1960	Otuhgn.exe	30
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 1960 wrote to memory of 2040	1960	Otuhgn.exe	29
PID 904 wrote to memory of 592	904	Otuhgn.exe	31
PID 904 wrote to memory of 592	904	Otuhgn.exe	31
PID 904 wrote to memory of 592	904	Otuhgn.exe	31
PID 904 wrote to memory of 592	904	Otuhgn.exe	31
PID 2040 wrote to memory of 568	2040	regasm.exe	32
PID 2040 wrote to memory of 568	2040	regasm.exe	32
PID 2040 wrote to memory of 568	2040	regasm.exe	32
PID 2040 wrote to memory of 568	2040	regasm.exe	32
PID 592 wrote to memory of 1808	592	intelgraphics.exe	33
PID 592 wrote to memory of 1808	592	intelgraphics.exe	33
PID 592 wrote to memory of 1808	592	intelgraphics.exe	33
PID 592 wrote to memory of 1808	592	intelgraphics.exe	33
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1824	1808	Otuhgn.exe	34
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1808 wrote to memory of 1952	1808	Otuhgn.exe	35
PID 1952 wrote to memory of 524	1952	Otuhgn.exe	36
PID 1952 wrote to memory of 524	1952	Otuhgn.exe	36
PID 1952 wrote to memory of 524	1952	Otuhgn.exe	36
PID 1952 wrote to memory of 524	1952	Otuhgn.exe	36
PID 1952 wrote to memory of 524	1952	Otuhgn.exe	36
PID 1952 wrote to memory of 524	1952	Otuhgn.exe	36

C:\Users\Admin\AppData\Local\Temp\Remittance.com.exe
"C:\Users\Admin\AppData\Local\Temp\Remittance.com.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Users\Admin\Documents\ebbbik\Otuhgn.exe
  "C:\Users\Admin\Documents\ebbbik\Otuhgn.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2040
  - - C:\Users\Admin\Documents\ebbbik\Otuhgn.exe
      "C:\Users\Admin\Documents\ebbbik\Otuhgn.exe"
      4⤵
      Executes dropped EXE
      PID:568
- - C:\Users\Admin\Documents\ebbbik\Otuhgn.exe
    "C:\Users\Admin\Documents\ebbbik\Otuhgn.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Loads dropped DLL
    - Adds Run key to start application
    - NTFS ADS
    - Suspicious use of WriteProcessMemory
    PID:904
  - - C:\ProgramData\intelgraphics.exe
      "C:\ProgramData\intelgraphics.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:592
    - - C:\Users\Admin\Documents\ebbbik\Otuhgn.exe
        
        "C:\Users\Admin\Documents\ebbbik\Otuhgn.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1808
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1824
      - C:\Users\Admin\Documents\ebbbik\Otuhgn.exe
        
        "C:\Users\Admin\Documents\ebbbik\Otuhgn.exe"
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of SetWindowsHookEx
        
        PID:1952
        
        C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        7⤵
        
        PID:524

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/524-71-0x0000000000270000-0x0000000000271000-memory.dmp

Download

memory/524-70-0x0000000000280000-0x0000000000281000-memory.dmp

Download

memory/568-40-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/568-38-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Download

memory/592-33-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Download

memory/592-37-0x0000000001230000-0x0000000001231000-memory.dmp

Download

memory/904-19-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/904-16-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1108-0-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Download

memory/1108-1-0x0000000000A70000-0x0000000000A71000-memory.dmp

Download

memory/1108-3-0x00000000005D0000-0x00000000005D4000-memory.dmp

Download

memory/1108-4-0x0000000000A30000-0x0000000000A63000-memory.dmp

Download

memory/1808-51-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/1808-50-0x00000000741E0000-0x00000000748CE000-memory.dmp

Download

memory/1824-64-0x00000000741E0000-0x00000000748CE000-memory.dmp

Download

memory/1952-63-0x0000000000400000-0x0000000000554000-memory.dmp

Download

memory/1960-11-0x0000000000390000-0x0000000000391000-memory.dmp

Download

memory/1960-10-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Download

memory/2040-20-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2040-27-0x0000000000300000-0x0000000000304000-memory.dmp

Download

memory/2040-23-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/2040-24-0x00000000748D0000-0x0000000074FBE000-memory.dmp

Download

memory/2040-22-0x0000000000400000-0x0000000000412000-memory.dmp

Download