General
-
Target
3c1d8dd5f8a5020c541e0d3828f1619d
-
Size
1.3MB
-
Sample
220719-jnz8asgcgm
-
MD5
3c1d8dd5f8a5020c541e0d3828f1619d
-
SHA1
6c6f33fd3f562eaf851860065c9f15bce9c3f5dd
-
SHA256
1092277208f16f6ff084d9e0c608de60ac2edd9ba63df180b107146958bb9374
-
SHA512
e87e235ea314699789eb74e374074d880676390631634baf28ab821b6e6be8e2635330c941338c0b1e08e17b829aabbfda67308210abcd4e215bc08ac6648642
Behavioral task
behavioral1
Sample
3c1d8dd5f8a5020c541e0d3828f1619d.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
3c1d8dd5f8a5020c541e0d3828f1619d.exe
Resource
win10v2004-20220718-en
Malware Config
Extracted
netwire
Wealthy2019.com.strangled.net:20190
wealthyme.ddns.net:20190
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
sunshineslisa
-
install_path
%AppData%\Imgburn\Host.exe
-
keylogger_dir
%AppData%\Logs\Imgburn\
-
lock_executable
false
-
offline_keylogger
true
-
password
sucess
-
registry_autorun
false
-
use_mutex
false
Extracted
warzonerat
wealth.warzonedns.com:5202
Targets
-
-
Target
3c1d8dd5f8a5020c541e0d3828f1619d
-
Size
1.3MB
-
MD5
3c1d8dd5f8a5020c541e0d3828f1619d
-
SHA1
6c6f33fd3f562eaf851860065c9f15bce9c3f5dd
-
SHA256
1092277208f16f6ff084d9e0c608de60ac2edd9ba63df180b107146958bb9374
-
SHA512
e87e235ea314699789eb74e374074d880676390631634baf28ab821b6e6be8e2635330c941338c0b1e08e17b829aabbfda67308210abcd4e215bc08ac6648642
Score10/10-
NetWire RAT payload
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzone RAT payload
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-