Overview

overview

10

Static

static

10

1cea1b0ce3...cs.exe

windows7-x64

10

1cea1b0ce3...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1cea1b0ce3822658c165bcb1c80929b0_NeikiAnalytics.exe

  • Size

    4.5MB

  • Sample

    240518-v4er3sfa83

  • MD5

    1cea1b0ce3822658c165bcb1c80929b0

  • SHA1

    9bd12ce0d114447cbcfb68aa8429f51d4b08c797

  • SHA256

    134cc82d1702f6af49b36b9404a26069bd655bbd1a7659c9412f85be2a502532

  • SHA512

    14123a26a2fc3846c9e8b87d4d215b08c61c024e688a023fa20d168ee807a3a8589935bc596aa0fa1bc82453a043fae363049cd51a955de73edd9ec3a56486c3

  • SSDEEP

    24576:K1gg4CppEI6GGfWDkOQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0L:K1XP6rPbNechC0bNechC0bNecl

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      1cea1b0ce3822658c165bcb1c80929b0_NeikiAnalytics.exe

    • Size

      4.5MB

    • MD5

      1cea1b0ce3822658c165bcb1c80929b0

    • SHA1

      9bd12ce0d114447cbcfb68aa8429f51d4b08c797

    • SHA256

      134cc82d1702f6af49b36b9404a26069bd655bbd1a7659c9412f85be2a502532

    • SHA512

      14123a26a2fc3846c9e8b87d4d215b08c61c024e688a023fa20d168ee807a3a8589935bc596aa0fa1bc82453a043fae363049cd51a955de73edd9ec3a56486c3

    • SSDEEP

      24576:K1gg4CppEI6GGfWDkOQDbGV6eH8tkxIbGD2JTu0GoWQDbGV6eH8tkxIbGD2JTu0L:K1XP6rPbNechC0bNechC0bNecl

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

3
T1547

Registry Run Keys / Startup Folder

2
T1547.001

Winlogon Helper DLL

1
T1547.004

Defense Evasion

Modify Registry

4
T1112

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks