Overview

overview

10

Static

static

10

5e172641f5...0N.exe

windows7-x64

10

5e172641f5...0N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5e172641f5d424d72e79c0fb996a2d0559f174a2c064be4639f5f6639a2da770N.exe

  • Size

    8.9MB

  • Sample

    241222-jkqvfszkfv

  • MD5

    8e04364442e09477844042a4c24140a0

  • SHA1

    6cd67c060242e083b2eac3e0fd62a245e471cd19

  • SHA256

    5e172641f5d424d72e79c0fb996a2d0559f174a2c064be4639f5f6639a2da770

  • SHA512

    d6961998678e19d49211e2d2921cd6e9d54c5e8f9a0a8433edba86eabe8ff9b4a03f4e14a90ccbb48a76b68cdaad759cb2acc44dd077605e0ddab28ee81e5aae

  • SSDEEP

    49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecc:K1+8e8e8f8e8e8R

Score
10/10
warzoneratdiscoveryevasioninfostealerpersistencerat

Malware Config

Targets

    • Target

      5e172641f5d424d72e79c0fb996a2d0559f174a2c064be4639f5f6639a2da770N.exe

    • Size

      8.9MB

    • MD5

      8e04364442e09477844042a4c24140a0

    • SHA1

      6cd67c060242e083b2eac3e0fd62a245e471cd19

    • SHA256

      5e172641f5d424d72e79c0fb996a2d0559f174a2c064be4639f5f6639a2da770

    • SHA512

      d6961998678e19d49211e2d2921cd6e9d54c5e8f9a0a8433edba86eabe8ff9b4a03f4e14a90ccbb48a76b68cdaad759cb2acc44dd077605e0ddab28ee81e5aae

    • SSDEEP

      49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecc:K1+8e8e8f8e8e8R

    Score
    10/10
    warzoneratdiscoveryevasioninfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • Modifies visiblity of hidden/system files in Explorer

      evasion

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Warzone RAT payload

      rat

    • Boot or Logon Autostart Execution: Active Setup

      Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks