Overview

overview

10

Static

static

10

cec3aecff4...aa.exe

windows7_x64

10

cec3aecff4...aa.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cec3aecff4e5bc341b1f05466843916a5ff33ef601e449384df69605864249aa

  • Size

    2.9MB

  • Sample

    210228-zrnwfy1wrx

  • MD5

    bc9e5a832c8a0a18b450b5bb34f6c3aa

  • SHA1

    e72819307d32592f48a7180a38be0abe6d7a8e2e

  • SHA256

    cec3aecff4e5bc341b1f05466843916a5ff33ef601e449384df69605864249aa

  • SHA512

    f30d1f9845d4af8d5c1af03298a2ddb2f87a8fe4df95acf6c837b5ebe25e1ff5ac28754a410023ac4855aca1f4619349129de23ee7a267fab4607c15d32554f7

Score
10/10
warzoneratxmrigevasioninfostealerminerpersistencerat

Malware Config

Targets

    • Target

      cec3aecff4e5bc341b1f05466843916a5ff33ef601e449384df69605864249aa

    • Size

      2.9MB

    • MD5

      bc9e5a832c8a0a18b450b5bb34f6c3aa

    • SHA1

      e72819307d32592f48a7180a38be0abe6d7a8e2e

    • SHA256

      cec3aecff4e5bc341b1f05466843916a5ff33ef601e449384df69605864249aa

    • SHA512

      f30d1f9845d4af8d5c1af03298a2ddb2f87a8fe4df95acf6c837b5ebe25e1ff5ac28754a410023ac4855aca1f4619349129de23ee7a267fab4607c15d32554f7

    Score
    10/10
    warzoneratxmrigevasioninfostealerminerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks