Overview

overview

10

Static

static

10

3b78da1203...8N.exe

windows7-x64

10

3b78da1203...8N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3b78da120334a8af9568e450bf05e4a2b64f52db6a5807ea4cca0174e3b9e6c8N.exe

  • Size

    8.9MB

  • Sample

    241123-deemcawphx

  • MD5

    b42a5cd67b0ca9a51bdf6449ce77dc30

  • SHA1

    bbf3645a0bcf5c63a2585acda377414d4307edf5

  • SHA256

    3b78da120334a8af9568e450bf05e4a2b64f52db6a5807ea4cca0174e3b9e6c8

  • SHA512

    2160de00101adc2f11625ca15480a9dfff04fd4a61f4a71167847e519a976d115509ffb0397c8d5287d3196926015e9a3f82b47af07c5bb9ab908623a6062533

  • SSDEEP

    49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNec9:K1+8e8e8f8e8e86

Score
10/10
warzoneratdiscoveryevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      3b78da120334a8af9568e450bf05e4a2b64f52db6a5807ea4cca0174e3b9e6c8N.exe

    • Size

      8.9MB

    • MD5

      b42a5cd67b0ca9a51bdf6449ce77dc30

    • SHA1

      bbf3645a0bcf5c63a2585acda377414d4307edf5

    • SHA256

      3b78da120334a8af9568e450bf05e4a2b64f52db6a5807ea4cca0174e3b9e6c8

    • SHA512

      2160de00101adc2f11625ca15480a9dfff04fd4a61f4a71167847e519a976d115509ffb0397c8d5287d3196926015e9a3f82b47af07c5bb9ab908623a6062533

    • SSDEEP

      49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNec9:K1+8e8e8f8e8e86

    Score
    10/10
    warzoneratdiscoveryevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks