Overview

overview

10

Static

static

dridex

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    32a3a8f36c4cab6e28a646f7db8659f132a98f2b7169155e543ec1e024dfc211

  • Size

    1.9MB

  • Sample

    211007-g7wccacbel

  • MD5

    6d883d583924bab2b456690401265966

  • SHA1

    b329b0209511e4f7a22a4de4b9f34b022202c3a5

  • SHA256

    32a3a8f36c4cab6e28a646f7db8659f132a98f2b7169155e543ec1e024dfc211

  • SHA512

    8a5faa79307c7eafdc2f753f2f39f914920d32cf5941da4f18876e06d920d46f6b05c18b67396e1c66abbfdfb41949a081c9309562ec7f41686e2eaed00ab1a3

Score
10/10
warzoneratinfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

23.94.199.19:5144

Targets

    • Target

      32a3a8f36c4cab6e28a646f7db8659f132a98f2b7169155e543ec1e024dfc211

    • Size

      1.9MB

    • MD5

      6d883d583924bab2b456690401265966

    • SHA1

      b329b0209511e4f7a22a4de4b9f34b022202c3a5

    • SHA256

      32a3a8f36c4cab6e28a646f7db8659f132a98f2b7169155e543ec1e024dfc211

    • SHA512

      8a5faa79307c7eafdc2f753f2f39f914920d32cf5941da4f18876e06d920d46f6b05c18b67396e1c66abbfdfb41949a081c9309562ec7f41686e2eaed00ab1a3

    Score
    10/10
    warzoneratinfostealerpersistenceratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Sets DLL path for service in the registry

      persistence

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks