warzonerat | 3def910ad2cf7e7eeed302b88d5433270182a4cc400f8aa3947c2405c4b77393 | Triage

Sharing

General

Target

3def910ad2cf7e7eeed302b88d5433270182a4cc400f8aa3947c2405c4b77393N
Size

1.8MB
Sample

241105-e47j4avgrq
MD5

8a9ad265ca2915d3e5a40259d4a783b0
SHA1

aeae826d72f9aad4eb8b789805215bb93b54b89f
SHA256

3def910ad2cf7e7eeed302b88d5433270182a4cc400f8aa3947c2405c4b77393
SHA512

5dee6a2380254fb6df9332a89bec61af0e0c5984d9a22540a147b724d704a4aff7e790ee8f65f29a82bf7dfd44dc993fabfec8e2cd5633f166ca4f7d8dcb4ef2
SSDEEP

12288:L99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN5A7W2FeDSIGVH/KIDgf:J1gg4CppEI6GGfWDkIQDbGV6eH81ka

Score

10^/10

warzonerat discovery evasion infostealer persistence rat

Malware Config

Targets

- Target
  
  3def910ad2cf7e7eeed302b88d5433270182a4cc400f8aa3947c2405c4b77393N
- Size
  
  1.8MB
- MD5
  
  8a9ad265ca2915d3e5a40259d4a783b0
- SHA1
  
  aeae826d72f9aad4eb8b789805215bb93b54b89f
- SHA256
  
  3def910ad2cf7e7eeed302b88d5433270182a4cc400f8aa3947c2405c4b77393
- SHA512
  
  5dee6a2380254fb6df9332a89bec61af0e0c5984d9a22540a147b724d704a4aff7e790ee8f65f29a82bf7dfd44dc993fabfec8e2cd5633f166ca4f7d8dcb4ef2
- SSDEEP
  
  12288:L99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN5A7W2FeDSIGVH/KIDgf:J1gg4CppEI6GGfWDkIQDbGV6eH81ka
Score

10^/10

warzonerat discovery evasion infostealer persistence rat
- Modifies WinLogon for persistence
  persistence
- Modifies visiblity of hidden/system files in Explorer
  evasion
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzonerat family
  warzonerat
- Warzone RAT payload
  rat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Active Setup

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

warzoneratdiscoveryevasioninfostealerpersistencerat

behavioral2

warzoneratdiscoveryevasioninfostealerpersistencerat