Overview

overview

10

Static

static

1

3abea4ab1f...1f.exe

windows7-x64

10

3abea4ab1f...1f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f.zip

  • Size

    251KB

  • Sample

    230321-qplvmaae36

  • MD5

    79427b574ee7c962bb77be538be289c6

  • SHA1

    4ef29bd1486cef078c8ad117ad07899a63f33626

  • SHA256

    ce9af1dff6dd261b4f036623198b75bb64febcef3ce4af5f4e4b51e8355adf3f

  • SHA512

    d13e758c6e5e41fc76b20756cc0edaafbf995c5a7192d7b74b95f0268b2bb08aec94eff892cb6e86e7afbd27481d94df24ca9a842e81f24d952f38187389b204

  • SSDEEP

    6144:c5C7pIDi68bJ/4zpHkvNJCHXo6MQdUUZECU6esw0P:c6zJ/4YNvuUZCUfv0P

Score
10/10
guloaderwarzoneratdownloaderinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

dnmpbczm0963fxtdplc.duckdns.org:5689

Targets

    • Target

      3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f.exe

    • Size

      267KB

    • MD5

      4dbe71a4ca0eaea634ec73b4a82d32a9

    • SHA1

      48ba9c1be52988de95bf1a2597fd573f96892895

    • SHA256

      3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f

    • SHA512

      5f157e987b2c2b25a2d66e49dcc583220da474bd8756b6ea8d206ebeb99e994a02f98800a081a750b885b576f20204b89b8632de956bf0d8cec9d5785c6fcd70

    • SSDEEP

      6144:GDOmbbC0309OSXjr2Z2UCEVSOuzAtf/QZv3z9jnnOldiUf:4bZ309//2HCEVNuzaf/QZvj1nki

    Score
    10/10
    guloaderwarzoneratdownloaderinfostealerpersistencerat

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

      downloaderguloader

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks