warzonerat | 424f9c5a1a18e8761ab0e7c549bd7a8d9d5c5824dcb4c812d8f3fa6cd5ed756e

General

Target
RPG-06708.exe
Size 907KB
Sample201222-rjfl7d4kln
SHA256 424f9c5a1a18e8761ab0e7c549bd7a8d9d5c5824dcb4c812d8f3fa6cd5ed756e
MD5 c5489dc2d64ae3ec8abcce20e4159eda
SHA1 b34cbcfeac6e2cfa83f81eb4ab9406bf3b598447
SHA512 a37ac08052f21590f446269494524316a584f14c838164e6d68036b786b6ca248914cc63f2ec0445aace33a23892a1b32173dda98f0fa0b55f9997bf5e9ef043
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

port15e.zapto.org:1313

Targets

- Target
  RPG-06708.exe
- Size 907KB
- SHA256 424f9c5a1a18e8761ab0e7c549bd7a8d9d5c5824dcb4c812d8f3fa6cd5ed756e
- MD5 c5489dc2d64ae3ec8abcce20e4159eda
- SHA1 b34cbcfeac6e2cfa83f81eb4ab9406bf3b598447
- SHA512 a37ac08052f21590f446269494524316a584f14c838164e6d68036b786b6ca248914cc63f2ec0445aace33a23892a1b32173dda98f0fa0b55f9997bf5e9ef043
- MD5 SHA1 SHA512
Score

10^/10

warzonerat infostealer persistence rat
- Suspicious use of NtCreateProcessExOtherParentProcess
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Warzone RAT Payload
  rat
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

WarzoneRat, AveMaria

Warzone RAT Payload

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2