warzonerat | 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 16:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Odeme_Fatura.exe
Size

582KB
MD5

7bee43d88ddd5717c4059960d4f7abbb
SHA1

51768285fb6047a523af3d28e3e8601fa17a181d
SHA256

913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3
SHA512

b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd
SSDEEP

12288:nSQ3xl2I6NRNXDrI9GeZnbfPJJgR5lbULc1tBWpK9s3FqFLtomQ:Bf6rNX1eVXjGbt1oqFLtoN

Score

10^/10

warzonerat infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

satgobleien.jumpingcrab.com:5201

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 11 IoCs

rat

resource	yara_rule
behavioral1/memory/2708-6-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2760-11-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2760-13-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2708-14-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2760-15-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2708-22-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2676-32-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2676-34-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2560-35-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2560-37-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2676-38-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Executes dropped EXE 3 IoCs

pid	Process
2956	vimages.exe
2676	vimages.exe
2560	vimages.exe

Loads dropped DLL 1 IoCs

pid	Process
2708	Odeme_Fatura.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vimages = "C:\\ProgramData\\vimages.exe"	Odeme_Fatura.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2644 set thread context of 2708	2644	Odeme_Fatura.exe	28
PID 2644 set thread context of 2760	2644	Odeme_Fatura.exe	29
PID 2956 set thread context of 2676	2956	vimages.exe	31
PID 2956 set thread context of 2560	2956	vimages.exe	32

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2644	Odeme_Fatura.exe
Token: SeDebugPrivilege	2956	vimages.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2708	2644	Odeme_Fatura.exe	28
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2644 wrote to memory of 2760	2644	Odeme_Fatura.exe	29
PID 2708 wrote to memory of 2956	2708	Odeme_Fatura.exe	30
PID 2708 wrote to memory of 2956	2708	Odeme_Fatura.exe	30
PID 2708 wrote to memory of 2956	2708	Odeme_Fatura.exe	30
PID 2708 wrote to memory of 2956	2708	Odeme_Fatura.exe	30
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2676	2956	vimages.exe	31
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32
PID 2956 wrote to memory of 2560	2956	vimages.exe	32

C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
"C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\ProgramData\vimages.exe
    "C:\ProgramData\vimages.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\ProgramData\vimages.exe
      C:\ProgramData\vimages.exe
      4⤵
      Executes dropped EXE
      PID:2676
  - - C:\ProgramData\vimages.exe
      C:\ProgramData\vimages.exe
      4⤵
      Executes dropped EXE
      PID:2560
- C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  C:\Users\Admin\AppData\Local\Temp\Odeme_Fatura.exe
  2⤵
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\vimages.exe

Filesize
582KB

MD5
7bee43d88ddd5717c4059960d4f7abbb

SHA1
51768285fb6047a523af3d28e3e8601fa17a181d

SHA256
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3

SHA512
b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd

Download Submit
memory/2560-37-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2560-35-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2644-3-0x0000000000490000-0x00000000004D0000-memory.dmp

Filesize
256KB

Download
memory/2644-4-0x00000000043C0000-0x0000000004454000-memory.dmp

Filesize
592KB

Download
memory/2644-5-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/2644-10-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2644-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2644-0-0x0000000000CD0000-0x0000000000D6C000-memory.dmp

Filesize
624KB

Download
memory/2644-1-0x0000000074550000-0x0000000074C3E000-memory.dmp

Filesize
6.9MB

Download
memory/2676-38-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2676-32-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2676-34-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2708-14-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2708-22-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2708-6-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2760-15-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2760-13-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2760-11-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2956-24-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2956-23-0x0000000001330000-0x00000000013CC000-memory.dmp

Filesize
624KB

Download
memory/2956-25-0x0000000004900000-0x0000000004940000-memory.dmp

Filesize
256KB

Download
memory/2956-36-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads