Overview

overview

10

Static

static

10

32ff6a972a...AS.exe

windows7-x64

10

32ff6a972a...AS.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32ff6a972a4fcd339cd48ab43fb19e50_NEAS

  • Size

    1.8MB

  • Sample

    240506-3n73pagf5z

  • MD5

    32ff6a972a4fcd339cd48ab43fb19e50

  • SHA1

    6e42aac220635f1ac1fc83b5243fa9f9978eaa45

  • SHA256

    38268fdc68b4b926627c6dd9c6879a27d098efb689960578bb34d8e5803e51d7

  • SHA512

    3d5bd671f67fff9d1ef37cd509f7b0c5165448182fb2ab0136c66ee1c9729db71e0e59b97e1f2018066f3baf4c528bf07b948bf103acf5d1ae57ad56c5461725

  • SSDEEP

    12288:Q99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSG9dA7W2FeDSIGVH/KIDgJ:k1gg4CppEI6GGfWDkMQDbGV6eH8tkI

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      32ff6a972a4fcd339cd48ab43fb19e50_NEAS

    • Size

      1.8MB

    • MD5

      32ff6a972a4fcd339cd48ab43fb19e50

    • SHA1

      6e42aac220635f1ac1fc83b5243fa9f9978eaa45

    • SHA256

      38268fdc68b4b926627c6dd9c6879a27d098efb689960578bb34d8e5803e51d7

    • SHA512

      3d5bd671f67fff9d1ef37cd509f7b0c5165448182fb2ab0136c66ee1c9729db71e0e59b97e1f2018066f3baf4c528bf07b948bf103acf5d1ae57ad56c5461725

    • SSDEEP

      12288:Q99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSG9dA7W2FeDSIGVH/KIDgJ:k1gg4CppEI6GGfWDkMQDbGV6eH8tkI

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks