Overview

overview

10

Static

static

10

96d55c6385...0N.exe

windows7-x64

10

96d55c6385...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    96d55c6385c32b3a9295cc9b931607a0N.exe

  • Size

    2.9MB

  • Sample

    240817-fb9z7axgla

  • MD5

    96d55c6385c32b3a9295cc9b931607a0

  • SHA1

    53b1fd5d145eaa6596624e6703d295b0ed83cc67

  • SHA256

    750661a7486ea656db8ef6fcde9a61ea38886356e73e51f179ddb3dd7819b251

  • SHA512

    dd9e556e69438a5b9992ad227f43baaa3b68b78c9be475588d8140b1d3c7ebf2b1028c4c0ba30aa4c96256313624f1eb55bd80cad2084d6e31ea5a34ea6845a4

  • SSDEEP

    24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHB:ATU7AAmw4gxeOw46fUbNecCCFbNecM

Score
10/10
warzoneratdiscoveryevasioninfostealerpersistenceratupx

Malware Config

Targets

    • Target

      96d55c6385c32b3a9295cc9b931607a0N.exe

    • Size

      2.9MB

    • MD5

      96d55c6385c32b3a9295cc9b931607a0

    • SHA1

      53b1fd5d145eaa6596624e6703d295b0ed83cc67

    • SHA256

      750661a7486ea656db8ef6fcde9a61ea38886356e73e51f179ddb3dd7819b251

    • SHA512

      dd9e556e69438a5b9992ad227f43baaa3b68b78c9be475588d8140b1d3c7ebf2b1028c4c0ba30aa4c96256313624f1eb55bd80cad2084d6e31ea5a34ea6845a4

    • SSDEEP

      24576:ATU7AAmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHB:ATU7AAmw4gxeOw46fUbNecCCFbNecM

    Score
    10/10
    warzoneratdiscoveryevasioninfostealerpersistenceratupx

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks