Overview

overview

10

Static

static

3

um_x64.exe

windows7-x64

10

um_x64.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    um_x64.exe

  • Size

    2.2MB

  • Sample

    250330-a1e88aylx4

  • MD5

    e2fc229dbf8224232d5281b1b9c12aca

  • SHA1

    36c57d932bff9db9c221911fcc676f00c21cf4e6

  • SHA256

    4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60

  • SHA512

    95d1e3383445210e4cc4574baf7fcd68fb68099f202534108a5120ce776f93b777d112a0175ee41ad5e91b18bddc864ebb89fe7c8817769c3fd16762f1e2a27b

  • SSDEEP

    12288:hw3Pj/+DfNCKml36Ych32o0Fcmr/bXrKT9xiAJ65TTlBDa+zB2av:C3LsN8

Score
10/10
warzoneratdiscoveryexecutioninfostealerrat

Malware Config

Targets

    • Target

      um_x64.exe

    • Size

      2.2MB

    • MD5

      e2fc229dbf8224232d5281b1b9c12aca

    • SHA1

      36c57d932bff9db9c221911fcc676f00c21cf4e6

    • SHA256

      4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60

    • SHA512

      95d1e3383445210e4cc4574baf7fcd68fb68099f202534108a5120ce776f93b777d112a0175ee41ad5e91b18bddc864ebb89fe7c8817769c3fd16762f1e2a27b

    • SSDEEP

      12288:hw3Pj/+DfNCKml36Ych32o0Fcmr/bXrKT9xiAJ65TTlBDa+zB2av:C3LsN8

    Score
    10/10
    warzoneratdiscoveryexecutioninfostealerrat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzonerat family

      warzonerat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks