Overview

overview

10

Static

static

3

e4a50ac640...0N.exe

windows7-x64

8

e4a50ac640...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e4a50ac640ca22cea06d0d212be4e5f0N.exe

  • Size

    6.7MB

  • Sample

    240906-e4dxsawenr

  • MD5

    e4a50ac640ca22cea06d0d212be4e5f0

  • SHA1

    3d7944cc986d93000d9835617c927dac10e55b31

  • SHA256

    750aa88d28de9fcbf28b9e21c82f2d56701ffe8f02d8ec975539e4cae1a1972e

  • SHA512

    5ebbf586d3c48d5f1a893841d93aa52f71a2cf570c80350416b86251c38e42103edefa169d7c498fb41dde2af6d51260955d98a2e03b8154f239d39a95ff86f5

  • SSDEEP

    98304:giUupNGhzkE7R7iUupNGhzkE7RR/fh6ImzzJoDfuBcMv+A73XA:Y+GhzkE71+GhzkE7jHh6ImzD+F

Score
10/10
warzoneratdiscoveryexecutioninfostealerpersistencerat

Malware Config

Targets

    • Target

      e4a50ac640ca22cea06d0d212be4e5f0N.exe

    • Size

      6.7MB

    • MD5

      e4a50ac640ca22cea06d0d212be4e5f0

    • SHA1

      3d7944cc986d93000d9835617c927dac10e55b31

    • SHA256

      750aa88d28de9fcbf28b9e21c82f2d56701ffe8f02d8ec975539e4cae1a1972e

    • SHA512

      5ebbf586d3c48d5f1a893841d93aa52f71a2cf570c80350416b86251c38e42103edefa169d7c498fb41dde2af6d51260955d98a2e03b8154f239d39a95ff86f5

    • SSDEEP

      98304:giUupNGhzkE7R7iUupNGhzkE7RR/fh6ImzzJoDfuBcMv+A73XA:Y+GhzkE71+GhzkE7jHh6ImzD+F

    Score
    10/10
    discoveryexecutionwarzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks