Overview

overview

10

Static

static

SO-19844 EIDCO.ppam

windows7_x64

10

SO-19844 EIDCO.ppam

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SO-19844 EIDCO.ppam

  • Size

    14KB

  • Sample

    210717-r7w1jzpctn

  • MD5

    24dd86688a277a16ca013809c71ab8c0

  • SHA1

    d3a1915ced9501a7ce269ee1ace23b4a50c8c5cd

  • SHA256

    643ce9630631fdc9051b4be5b3bd9d60281885380fb2fa777379711d938c3c91

  • SHA512

    89888f15eaacf0404e460830f497b2465bbaf75276e5cf5b0ae7420f50f9c00c4392479bb2cee291acbeefda71e4dd4d603b915244ed932d84608f8fc65b5119

Score
10/10
warzoneratinfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

pstericdd.duckdns.org:9090

Targets

    • Target

      SO-19844 EIDCO.ppam

    • Size

      14KB

    • MD5

      24dd86688a277a16ca013809c71ab8c0

    • SHA1

      d3a1915ced9501a7ce269ee1ace23b4a50c8c5cd

    • SHA256

      643ce9630631fdc9051b4be5b3bd9d60281885380fb2fa777379711d938c3c91

    • SHA512

      89888f15eaacf0404e460830f497b2465bbaf75276e5cf5b0ae7420f50f9c00c4392479bb2cee291acbeefda71e4dd4d603b915244ed932d84608f8fc65b5119

    Score
    10/10
    warzoneratinfostealerpersistenceratspywarestealer

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Blocklisted process makes network request

    • Sets DLL path for service in the registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Modifies WinLogon

      persistence

    • Process spawned suspicious child process

      This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

4
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks