Overview

overview

10

Static

static

fa1bf2c3e9...e9.exe

windows7_x64

10

fa1bf2c3e9...e9.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fa1bf2c3e92bf67c61bd482b3b4e20e9.exe

  • Size

    847KB

  • Sample

    210116-bs6n8hm542

  • MD5

    fa1bf2c3e92bf67c61bd482b3b4e20e9

  • SHA1

    d0f8938c1249fca3eb5d0ecb76a21bcfc3cd5bb4

  • SHA256

    8186a0a03d0def9de9dce80543f12336eb276a7404e9da4680c170cfdd58b03d

  • SHA512

    47d9a06b14652ed54dfa0cfa09b6a918537dbb3fed10ed14a313b94f66b9dbcd15d3c4cf13aa0f6b5bb3292ae91ecef4d0a4de8061af29e5a18db4bc9c3c29fd

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

79.134.225.23:5200

Targets

    • Target

      fa1bf2c3e92bf67c61bd482b3b4e20e9.exe

    • Size

      847KB

    • MD5

      fa1bf2c3e92bf67c61bd482b3b4e20e9

    • SHA1

      d0f8938c1249fca3eb5d0ecb76a21bcfc3cd5bb4

    • SHA256

      8186a0a03d0def9de9dce80543f12336eb276a7404e9da4680c170cfdd58b03d

    • SHA512

      47d9a06b14652ed54dfa0cfa09b6a918537dbb3fed10ed14a313b94f66b9dbcd15d3c4cf13aa0f6b5bb3292ae91ecef4d0a4de8061af29e5a18db4bc9c3c29fd

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks