Overview

overview

10

Static

static

10

for 176.12...43.exe

windows7_x64

10

for 176.12...43.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    for 176.126.86.243.exe

  • Size

    113KB

  • Sample

    211006-jjjdzsagb5

  • MD5

    bd5f146a5f4796e27868d4ca83dae4ee

  • SHA1

    cfa2a086c52c94d387c0ab19b514881b47ab4490

  • SHA256

    066c455fdfc44d36695e2e0a97c41c25e8d2d21a90576f649159b16af4ffd860

  • SHA512

    5f2cfffde1a60fc3810330304611c39b8350fdc7b87e5e0e2a4186647ab8a68ca23cd5259bc3672db0c3505ff9fcccad5797f511531a7eabc6bc56b705e129a4

Score
10/10
warzoneratinfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

176.126.86.243:2021

Targets

    • Target

      for 176.126.86.243.exe

    • Size

      113KB

    • MD5

      bd5f146a5f4796e27868d4ca83dae4ee

    • SHA1

      cfa2a086c52c94d387c0ab19b514881b47ab4490

    • SHA256

      066c455fdfc44d36695e2e0a97c41c25e8d2d21a90576f649159b16af4ffd860

    • SHA512

      5f2cfffde1a60fc3810330304611c39b8350fdc7b87e5e0e2a4186647ab8a68ca23cd5259bc3672db0c3505ff9fcccad5797f511531a7eabc6bc56b705e129a4

    Score
    10/10
    warzoneratinfostealerpersistenceratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks