Overview

overview

10

Static

static

10

c97ae84e27...9d.exe

windows7_x64

10

c97ae84e27...9d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c97ae84e271bc4f1ae277c32b97e59160531d601421a110ee31468e451f3fa9d

  • Size

    1.8MB

  • Sample

    210505-qclvf2mtaj

  • MD5

    fd88e732993de57ca0bfd7d092c26131

  • SHA1

    b3ad7ac5a3531a84654b1ac2364c12242de08f66

  • SHA256

    c97ae84e271bc4f1ae277c32b97e59160531d601421a110ee31468e451f3fa9d

  • SHA512

    5d45fd176f8e5e57e7077919afb14b47f8a3818377b47a21ce11f5ac5a74df46d6ead66e7acdfdeb04aeb3c1c667b196f6cc6378db21a3a82c80d471f472b148

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      c97ae84e271bc4f1ae277c32b97e59160531d601421a110ee31468e451f3fa9d

    • Size

      1.8MB

    • MD5

      fd88e732993de57ca0bfd7d092c26131

    • SHA1

      b3ad7ac5a3531a84654b1ac2364c12242de08f66

    • SHA256

      c97ae84e271bc4f1ae277c32b97e59160531d601421a110ee31468e451f3fa9d

    • SHA512

      5d45fd176f8e5e57e7077919afb14b47f8a3818377b47a21ce11f5ac5a74df46d6ead66e7acdfdeb04aeb3c1c667b196f6cc6378db21a3a82c80d471f472b148

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Hidden Files and Directories

1
T1158

Registry Run Keys / Startup Folder

2
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks