Overview

overview

10

Static

static

1

3abea4ab1f...1f.exe

windows7-x64

10

3abea4ab1f...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4dbe71a4ca0eaea634ec73b4a82d32a9.bin

  • Size

    251KB

  • Sample

    230316-hmbb4she46

  • MD5

    40b2008f1bfe9bf1d52b8c37f18e7929

  • SHA1

    172617e2639476b69ee8ea3f17de7cc5908dc63f

  • SHA256

    9f4b58127cf9e91dd771931822dbd3c2a23e64027627cab20973ca839e196e11

  • SHA512

    cddbc07994753894a3052392d95c17f12e557fd718cf3d437308582598627678aba8a415a4be0abfc853320d9ce407e60f20a838d2487464e5a369231d57d609

  • SSDEEP

    6144:QpssvHRuAaIHXI56dG0j1UDDHNU/l9joOdTBAR6uS6:kvYAE6dG0tN9FTKR6y

Score
10/10
guloaderwarzoneratdownloaderinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

dnmpbczm0963fxtdplc.duckdns.org:5689

Targets

    • Target

      3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f.exe

    • Size

      267KB

    • MD5

      4dbe71a4ca0eaea634ec73b4a82d32a9

    • SHA1

      48ba9c1be52988de95bf1a2597fd573f96892895

    • SHA256

      3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f

    • SHA512

      5f157e987b2c2b25a2d66e49dcc583220da474bd8756b6ea8d206ebeb99e994a02f98800a081a750b885b576f20204b89b8632de956bf0d8cec9d5785c6fcd70

    • SSDEEP

      6144:GDOmbbC0309OSXjr2Z2UCEVSOuzAtf/QZv3z9jnnOldiUf:4bZ309//2HCEVNuzaf/QZvj1nki

    Score
    10/10
    guloaderwarzoneratdownloaderinfostealerpersistencerat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks