Overview

overview

10

Static

static

10

d49cfc47e8...04.exe

windows7_x64

10

d49cfc47e8...04.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d49cfc47e8bfcee37048d17897a73fe10905f5100af5663c0915e812d25b6804

  • Size

    1.8MB

  • Sample

    210517-cchcykb6xs

  • MD5

    a01baf08c10a47c48ce4891fce9a1544

  • SHA1

    ff1eb7a50534c1351ad854a99ab59ea1ecd9971f

  • SHA256

    d49cfc47e8bfcee37048d17897a73fe10905f5100af5663c0915e812d25b6804

  • SHA512

    d0067360009a4c6bcb49b19e02024bd5b60ee1c5e0cb1391e9c59cd2a383b9587cea41464276cb803eaf58b14b540d2d04c421c9ddb6c5f4a462c9261359e184

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      d49cfc47e8bfcee37048d17897a73fe10905f5100af5663c0915e812d25b6804

    • Size

      1.8MB

    • MD5

      a01baf08c10a47c48ce4891fce9a1544

    • SHA1

      ff1eb7a50534c1351ad854a99ab59ea1ecd9971f

    • SHA256

      d49cfc47e8bfcee37048d17897a73fe10905f5100af5663c0915e812d25b6804

    • SHA512

      d0067360009a4c6bcb49b19e02024bd5b60ee1c5e0cb1391e9c59cd2a383b9587cea41464276cb803eaf58b14b540d2d04c421c9ddb6c5f4a462c9261359e184

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Modifies Installed Components in the registry

      persistence

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks