Overview

overview

10

Static

static

10

b0a8d3a7a0...eN.exe

windows7-x64

10

b0a8d3a7a0...eN.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0a8d3a7a0a55ea3d5192627c832c9a45c5aa132a718d13a8ed780e4f93cc7deN.exe

  • Size

    1.8MB

  • Sample

    241215-3qjswasqby

  • MD5

    baf30b392130665d203fdabd174c3ac0

  • SHA1

    f5000cb8f8be4ab71812442d0414f95c4670f0ed

  • SHA256

    b0a8d3a7a0a55ea3d5192627c832c9a45c5aa132a718d13a8ed780e4f93cc7de

  • SHA512

    2eee93e295512d37c55ad7ded372dd0bf7d5d2db3462e0fc6e0c7cc9cd8472783ac269027b57a4b792972f65e092d4d3d13cb4b9f776b8614ffcb9eeaae29840

  • SSDEEP

    12288:i254f/VAuj79umm3xR0lq+X6kOyeXiYxewRJBWW59qA7W2FeDSIGVH/KIDgDgUeC:x+D9uVMpjOyerrFQDbGV6eH81k+

Score
10/10
warzoneratdiscoveryevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      b0a8d3a7a0a55ea3d5192627c832c9a45c5aa132a718d13a8ed780e4f93cc7deN.exe

    • Size

      1.8MB

    • MD5

      baf30b392130665d203fdabd174c3ac0

    • SHA1

      f5000cb8f8be4ab71812442d0414f95c4670f0ed

    • SHA256

      b0a8d3a7a0a55ea3d5192627c832c9a45c5aa132a718d13a8ed780e4f93cc7de

    • SHA512

      2eee93e295512d37c55ad7ded372dd0bf7d5d2db3462e0fc6e0c7cc9cd8472783ac269027b57a4b792972f65e092d4d3d13cb4b9f776b8614ffcb9eeaae29840

    • SSDEEP

      12288:i254f/VAuj79umm3xR0lq+X6kOyeXiYxewRJBWW59qA7W2FeDSIGVH/KIDgDgUeC:x+D9uVMpjOyerrFQDbGV6eH81k+

    Score
    10/10
    warzoneratdiscoveryevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks