Analysis
-
max time kernel
174s -
max time network
187s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
26-08-2022 06:32
General
-
Target
CgENMjeJGCZcdAF.exe
-
Size
98KB
-
MD5
92dcfe5ccfa95ab24ed7ed2933181a8b
-
SHA1
027ac2613387cd54463d0170889b849201f16e85
-
SHA256
8e4f9c50d684e420c808b44d32287262f57cdbb5780dca6488556a41107d3491
-
SHA512
86e515a88fc33b0c8773a4caa53521a96f4cf04ca09b80c79e8687363e5b054a0e82e275e8cb72c899233897a5353946ef68791673cfdb0605aac35c8c2d217e
-
SSDEEP
1536:5Csejmb+6BQyusX1UjtA0uWRf/eloc/9T1jVEyp:AtD6jSm0uWRfCogTjVEG
Score
10/10
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 2 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\CgENMjeJGCZcdAF.exe"C:\Users\Admin\AppData\Local\Temp\CgENMjeJGCZcdAF.exe"1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
528KB