Overview

overview

10

Static

static

SecuriteIn...58.exe

windows7-x64

10

SecuriteIn...58.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    226s
  • max time network
    316s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    01-12-2022 03:30

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    SecuriteInfo.com.Win32.RATX-gen.3212.5858.exe

  • Size

    60KB

  • MD5

    8c4b7521e74a3960a77f70f53179670e

  • SHA1

    c775546bdb0e2d4401e391d075cfcc0b863c8774

  • SHA256

    cea6d4fbb54e357c9c62deab33a97e5e94b91f7f95a39a6e5daf5dd69133b6d7

  • SHA512

    c683bb89b0301f330a22609c4b810c241a63964c53f4c9ae544f89d356009977714e70d8b9481bc89055c760a0a6de45dbe5b9d55ab3b432b71ddad1e643e1a7

  • SSDEEP

    1536:/iyl1nZJJMZ4jTjx6WZG/YGcO/R4UMz5Tu:/iybnBGc1u

Score
10/10
warzoneratinfostealerrat

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzone RAT payload 8 IoCs
    rat
  • Drops startup file 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.3212.5858.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.3212.5858.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.3212.5858.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.RATX-gen.3212.5858.exe"
      2⤵
        PID:1660

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Install Root Certificate

    1
    T1130

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1256-54-0x00000000003B0000-0x00000000003C6000-memory.dmp
      Filesize

      88KB

      Download
    • memory/1256-55-0x0000000075D11000-0x0000000075D13000-memory.dmp
      Filesize

      8KB

      Download
    • memory/1256-56-0x0000000000380000-0x00000000003A8000-memory.dmp
      Filesize

      160KB

      Download
    • memory/1256-57-0x00000000003D0000-0x00000000003D8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/1256-58-0x00000000006E0000-0x00000000006E8000-memory.dmp
      Filesize

      32KB

      Download
    • memory/1660-59-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-60-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-62-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-64-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-65-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-67-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-69-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-70-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-71-0x000000000040B556-mapping.dmp
      Download
    • memory/1660-74-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download
    • memory/1660-75-0x0000000000400000-0x0000000000568000-memory.dmp
      Filesize

      1.4MB

      Download