Analysis
-
max time kernel
149s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
17-04-2024 14:39
Static task
static1
Behavioral task
behavioral1
Sample
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe
Resource
win10v2004-20240412-en
General
-
Target
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe
-
Size
582KB
-
MD5
7bee43d88ddd5717c4059960d4f7abbb
-
SHA1
51768285fb6047a523af3d28e3e8601fa17a181d
-
SHA256
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3
-
SHA512
b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd
-
SSDEEP
12288:nSQ3xl2I6NRNXDrI9GeZnbfPJJgR5lbULc1tBWpK9s3FqFLtomQ:Bf6rNX1eVXjGbt1oqFLtoN
Malware Config
Extracted
warzonerat
satgobleien.jumpingcrab.com:5201
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload 9 IoCs
Processes:
resource yara_rule behavioral1/memory/2528-7-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2528-9-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2528-11-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2528-18-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2736-33-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2736-29-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2600-34-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2600-36-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat behavioral1/memory/2736-37-0x0000000000400000-0x0000000000554000-memory.dmp warzonerat -
Executes dropped EXE 3 IoCs
Processes:
vimages.exevimages.exevimages.exepid process 2648 vimages.exe 2736 vimages.exe 2600 vimages.exe -
Loads dropped DLL 3 IoCs
Processes:
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exevimages.exepid process 2528 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 2648 vimages.exe 2648 vimages.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\vimages = "C:\\ProgramData\\vimages.exe" 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exevimages.exedescription pid process target process PID 2064 set thread context of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 set thread context of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2648 set thread context of 2736 2648 vimages.exe vimages.exe PID 2648 set thread context of 2600 2648 vimages.exe vimages.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exevimages.exedescription pid process Token: SeDebugPrivilege 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe Token: SeDebugPrivilege 2648 vimages.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exevimages.exedescription pid process target process PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 3044 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2064 wrote to memory of 2528 2064 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe PID 2528 wrote to memory of 2648 2528 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe vimages.exe PID 2528 wrote to memory of 2648 2528 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe vimages.exe PID 2528 wrote to memory of 2648 2528 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe vimages.exe PID 2528 wrote to memory of 2648 2528 913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2736 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe PID 2648 wrote to memory of 2600 2648 vimages.exe vimages.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe"C:\Users\Admin\AppData\Local\Temp\913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2064 -
C:\Users\Admin\AppData\Local\Temp\913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exeC:\Users\Admin\AppData\Local\Temp\913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe2⤵PID:3044
-
C:\Users\Admin\AppData\Local\Temp\913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exeC:\Users\Admin\AppData\Local\Temp\913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2528 -
C:\ProgramData\vimages.exe"C:\ProgramData\vimages.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\ProgramData\vimages.exeC:\ProgramData\vimages.exe4⤵
- Executes dropped EXE
PID:2736 -
C:\ProgramData\vimages.exeC:\ProgramData\vimages.exe4⤵
- Executes dropped EXE
PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
582KB
MD57bee43d88ddd5717c4059960d4f7abbb
SHA151768285fb6047a523af3d28e3e8601fa17a181d
SHA256913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3
SHA512b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd