Overview

overview

10

Static

static

10

7eaa2c0c3c...f3.exe

windows7_x64

10

7eaa2c0c3c...f3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7eaa2c0c3cd26e9495e9de67413f860820a713141429e921861d239d80475df3

  • Size

    2.9MB

  • Sample

    210228-wt2mzysgjj

  • MD5

    b2ed1b38dc16e2d3e46c1748f06871fc

  • SHA1

    deafaba66dfcbdee771b44562a958824899136e0

  • SHA256

    7eaa2c0c3cd26e9495e9de67413f860820a713141429e921861d239d80475df3

  • SHA512

    e7d1301ce915de74ea7d8245c7c03ce3cf60840d46d35e5bf9063124f49a06eb08795cde0705d28c120d96c96f1f26b31374e832d02ee962bf0a6eb9675a6bf9

Score
10/10
warzoneratxmrigevasioninfostealerminerpersistencerat

Malware Config

Targets

    • Target

      7eaa2c0c3cd26e9495e9de67413f860820a713141429e921861d239d80475df3

    • Size

      2.9MB

    • MD5

      b2ed1b38dc16e2d3e46c1748f06871fc

    • SHA1

      deafaba66dfcbdee771b44562a958824899136e0

    • SHA256

      7eaa2c0c3cd26e9495e9de67413f860820a713141429e921861d239d80475df3

    • SHA512

      e7d1301ce915de74ea7d8245c7c03ce3cf60840d46d35e5bf9063124f49a06eb08795cde0705d28c120d96c96f1f26b31374e832d02ee962bf0a6eb9675a6bf9

    Score
    10/10
    warzoneratxmrigevasioninfostealerminerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks