Overview

overview

10

Static

static

10

69ee759f52...e5.exe

windows7_x64

10

69ee759f52...e5.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    69ee759f52c353add075c24cf5e998b31cd2386f66a9c91f6f876eb636c54ee5

  • Size

    2.9MB

  • Sample

    210228-5yyt7zf4ex

  • MD5

    bae582e3781b693c05fb1a65d7496500

  • SHA1

    1a38ec721cc0b688564e0281282f07551a660fc0

  • SHA256

    69ee759f52c353add075c24cf5e998b31cd2386f66a9c91f6f876eb636c54ee5

  • SHA512

    ec015852a100dda336d2785490ca18619baa692200ca940950500829a802f9205706c7e89b02a2c43294e525ca29065c6d3f19a40d80546f25ca65c152974371

Score
10/10
warzoneratxmrigevasioninfostealerminerpersistencerat

Malware Config

Targets

    • Target

      69ee759f52c353add075c24cf5e998b31cd2386f66a9c91f6f876eb636c54ee5

    • Size

      2.9MB

    • MD5

      bae582e3781b693c05fb1a65d7496500

    • SHA1

      1a38ec721cc0b688564e0281282f07551a660fc0

    • SHA256

      69ee759f52c353add075c24cf5e998b31cd2386f66a9c91f6f876eb636c54ee5

    • SHA512

      ec015852a100dda336d2785490ca18619baa692200ca940950500829a802f9205706c7e89b02a2c43294e525ca29065c6d3f19a40d80546f25ca65c152974371

    Score
    10/10
    warzoneratxmrigevasioninfostealerminerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks