Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
08/07/2023, 20:37
General
-
Target
211BB570BD70A89E4680D34451DD3350.exe
-
Size
908KB
-
MD5
211bb570bd70a89e4680d34451dd3350
-
SHA1
da743c57a2b1727e3da7cdf8e98b9cba93ecb862
-
SHA256
cd26009a2cfa0a5f8b8e44786b045b4a0d8faf78ae5ae044a64226f3ced2bda7
-
SHA512
da76993cf60de3d5edea9de33972409c689eaeb82c2c1afde3fbf4e5b79a2ab476caf127c1999be6b281e31bb7f9f1fe041fdc1e3882a532723dfb7bcd0b3e4d
-
SSDEEP
24576:xgLzNa28Rcr2O86+6MDUlnEXYfWGOvD7QKM:xgL4HA2/KrJ
Score
10/10
Malware Config
Extracted
Family
warzonerat
C2
mywarswarw.ddns.net:5200
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage 1 IoCs
-
Warzone RAT payload 3 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\211BB570BD70A89E4680D34451DD3350.exe"C:\Users\Admin\AppData\Local\Temp\211BB570BD70A89E4680D34451DD3350.exe"1⤵
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
196KB
-
Filesize
940KB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.4MB
-
Filesize
1.6MB
-
Filesize
1.4MB