Analysis
-
max time kernel
143s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
-
submitted
10-07-2023 13:30
General
-
Target
PAYMENTADICE565OUTBOUNDex.exe
-
Size
948KB
-
MD5
268ad9d551b4173c3bfd39eef6ad76b9
-
SHA1
6ca84e053936508354a7805f36b1fd7e25f6970e
-
SHA256
a08cd110a928227dd4b3b42b1801bc1c907dd042bea8494ac701142c5eb345da
-
SHA512
03f5fd63552e49d6fb2ad05596429fb2352c7384d084da7f45df04cf70eb4886d77871cb7f4321f65b62c1ec18d232ed372046d609ae559b303bd941c5567ef9
-
SSDEEP
12288:5DQy2c+bp9/95hiFFCt2AvQBPNIkry/wNQZqLfLYUj2Msx2AWwoo+5dHg:5cnbp9mIzvQBa1/wNQULfLYUyVxHjohM
Score
10/10
Malware Config
Extracted
Family
warzonerat
C2
donelpacino.ddns.net:4545
Signatures
-
ModiLoader, DBatLoader
ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
ModiLoader Second Stage 1 IoCs
-
Warzone RAT payload 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Script User-Agent 2 IoCs
Uses user-agent string associated with script host/environment.
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENTADICE565OUTBOUNDex.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENTADICE565OUTBOUNDex.exe"1⤵
- Adds Run key to start application
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
4KB
-
Filesize
972KB
-
Filesize
1.4MB