Overview

overview

10

Static

static

3

um_x64.exe

windows7-x64

10

um_x64.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    30/03/2025, 00:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    um_x64.exe

  • Size

    2.2MB

  • MD5

    e2fc229dbf8224232d5281b1b9c12aca

  • SHA1

    36c57d932bff9db9c221911fcc676f00c21cf4e6

  • SHA256

    4ac725ff452104c51cf1cd896797b3c46dfd9fdff4fcb4cb0b78b74a122bcd60

  • SHA512

    95d1e3383445210e4cc4574baf7fcd68fb68099f202534108a5120ce776f93b777d112a0175ee41ad5e91b18bddc864ebb89fe7c8817769c3fd16762f1e2a27b

  • SSDEEP

    12288:hw3Pj/+DfNCKml36Ych32o0Fcmr/bXrKT9xiAJ65TTlBDa+zB2av:C3LsN8

Score
10/10
warzoneratdiscoveryexecutioninfostealerrat

Malware Config

Signatures

  • WarzoneRat, AveMaria

    WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    ratinfostealerwarzonerat
  • Warzonerat family
    warzonerat
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Drops startup file 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • NTFS ADS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\um_x64.exe
      "C:\Users\Admin\AppData\Local\Temp\um_x64.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe
        "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"
        3⤵
        • Drops startup file
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • NTFS ADS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1672
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell Add-MpPreference -ExclusionPath C:\
          4⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2824
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2832
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe"
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2648
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe"
          4⤵
          • System Location Discovery: System Language Discovery
          PID:2936
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 1600 -s 328
        3⤵
          PID:1620

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\Windows App Certification Kit\$wz$sd_nj$dvz.exe
      Filesize

      2.2MB

      MD5

      d18f0b30efd9f100f11f81825bae050b

      SHA1

      eacd3786e86ee03b14300c2dc6a08e5cfa2406bf

      SHA256

      73c15f93c957b337b30e6b6712487234738a3e0569611d3aac49896582f7b54c

      SHA512

      e6987f4a553699e80b64217919a066eab2e2f81d13c6c4e53c0c5b423c17ac7f129b86b56512de2e45e21d840e0ba3629ffd6ed2aadb84d4ff19521371e00560

      Download Submit

    • memory/1284-27-0x0000000002F20000-0x0000000002F26000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1284-26-0x0000000004D10000-0x0000000004E10000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1284-33-0x0000000002F20000-0x0000000002F26000-memory.dmp

      Filesize

      24KB

      Download

    • memory/1672-5-0x00000000767BF000-0x00000000767C0000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1672-6-0x0000000076750000-0x0000000076850000-memory.dmp

      Filesize

      1024KB

      Download

    • memory/1672-7-0x0000000000910000-0x0000000000A9C000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1672-12-0x0000000000910000-0x0000000000A9C000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/1672-24-0x0000000000910000-0x0000000000A9C000-memory.dmp

      Filesize

      1.5MB

      Download

    • memory/2936-19-0x00000000000B0000-0x00000000000B1000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2936-21-0x00000000000B0000-0x00000000000B1000-memory.dmp

      Filesize

      4KB

      Download