Overview

overview

10

Static

static

10

649c98f7d7...cs.exe

windows7-x64

10

649c98f7d7...cs.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    649c98f7d7d62444782d5501a15f1ed0_NeikiAnalytics.exe

  • Size

    2.9MB

  • Sample

    240530-e41fsaef5t

  • MD5

    649c98f7d7d62444782d5501a15f1ed0

  • SHA1

    97ec6d7b1818ef54ab90dcc39381ca5fbdaa9232

  • SHA256

    d21a61b15fe5ee10189b92fdddb71c8183cec4ea6180bfc3ac5d4e59a2e87bbd

  • SHA512

    32b94184a86fe9bd7e603460cf0f0ec20fffea9ac836efc31126fc48024a88c40d718b48734ffcab1949490019d90c98ed7bc92a42c334b53c15f956a66d5bc9

  • SSDEEP

    24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHN:7v97AXmw4gxeOw46fUbNecCCFbNecu

Score
10/10
warzoneratevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      649c98f7d7d62444782d5501a15f1ed0_NeikiAnalytics.exe

    • Size

      2.9MB

    • MD5

      649c98f7d7d62444782d5501a15f1ed0

    • SHA1

      97ec6d7b1818ef54ab90dcc39381ca5fbdaa9232

    • SHA256

      d21a61b15fe5ee10189b92fdddb71c8183cec4ea6180bfc3ac5d4e59a2e87bbd

    • SHA512

      32b94184a86fe9bd7e603460cf0f0ec20fffea9ac836efc31126fc48024a88c40d718b48734ffcab1949490019d90c98ed7bc92a42c334b53c15f956a66d5bc9

    • SSDEEP

      24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHN:7v97AXmw4gxeOw46fUbNecCCFbNecu

    Score
    10/10
    warzoneratevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Modifies Installed Components in the registry

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks