warzonerat | 38a7b50472d2fbc4d4d76ef0936ceafa31606153a36e7afa3d7952539dfa0c2f

General

Target
00db430a07a7ebfe2dda4d10bffbde37
Size 697KB
Sample210823-nednwbf42a
SHA256 38a7b50472d2fbc4d4d76ef0936ceafa31606153a36e7afa3d7952539dfa0c2f
MD5 00db430a07a7ebfe2dda4d10bffbde37
SHA1 dcbbc675debc38a6f6f375ce7aaf7e6f2fdf4a8f
SHA512 922d569efe1cdf81524f5a9e949c86086775e11664cd539935a2fc4ae4f15217ad0c747516357a60f5f1d219b93db45561ce191b6cf19c8cf541e735a0efaa96
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Family

warzonerat

C2

Securedbag2021-48502.portmap.host:48502

Targets

- Target
  00db430a07a7ebfe2dda4d10bffbde37
- Size 697KB
- SHA256 38a7b50472d2fbc4d4d76ef0936ceafa31606153a36e7afa3d7952539dfa0c2f
- MD5 00db430a07a7ebfe2dda4d10bffbde37
- SHA1 dcbbc675debc38a6f6f375ce7aaf7e6f2fdf4a8f
- SHA512 922d569efe1cdf81524f5a9e949c86086775e11664cd539935a2fc4ae4f15217ad0c747516357a60f5f1d219b93db45561ce191b6cf19c8cf541e735a0efaa96
- MD5 SHA1 SHA512
Score

10^/10

warzonerat infostealer persistence rat
- WarzoneRat, AveMaria
  WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
  rat infostealer warzonerat
- Sets DLL path for service in the registry
  persistence
- Loads dropped DLL
- Modifies WinLogon
  persistence
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

WarzoneRat, AveMaria

Sets DLL path for service in the registry

Loads dropped DLL

Modifies WinLogon

Drops file in System32 directory

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2