Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
16-12-2024 22:35
General
-
Target
2024-12-13_f075083179d973bbd0a8651e09abb523_mafia.exe
-
Size
13.9MB
-
MD5
f075083179d973bbd0a8651e09abb523
-
SHA1
f884c38e1a974ab8c47b33412fe651fb5232c453
-
SHA256
7e806494c37cbe06a01e52f1b1c602c6ea00ba7018994e975c667f119a1b57bc
-
SHA512
3d11415e68f1d8cc6f038efaa8d0938bde52e132ddbb5faa6a67dcc676eccc22817ab7c5db60cb5c3b99f2c26809b345c40abcc57756856d1f2dadf64fdf7247
-
SSDEEP
98304:BDlgLVmVkOZJ0kfvwW3nlyU5t9qBDhcsPGIGf8O:BDAetfv/3nt5tscAGIs8O
Score
10/10
Malware Config
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-12-13_f075083179d973bbd0a8651e09abb523_mafia.exe"C:\Users\Admin\AppData\Local\Temp\2024-12-13_f075083179d973bbd0a8651e09abb523_mafia.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3764 -s 5002⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 124 -p 3764 -ip 37641⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
116KB
-
Filesize
116KB