Overview

overview

10

Static

static

PCS TENDER...20.exe

windows7_x64

1

PCS TENDER...20.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PCS TENDER PROFILE-20210920.r00

  • Size

    5KB

  • Sample

    211012-s4cllscfd3

  • MD5

    9de06e8a49941048af4a52b9a8e4504c

  • SHA1

    7ce57379d122822d2ff040c4704fc86dbe711517

  • SHA256

    dbce69c132d28f4b9f33cecfd7991bf1d8cfa043c534c9fd724fd6d1413619af

  • SHA512

    4543fee35a79e885600a2e6967948dda444e9858d2edb184c47e78ed16622495dd97f805b7ced7ff00912e7b2a9b57d1b00befb2e4e27b0b85356e3920816bb0

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

enginekeysmoney.ddns.net:9671

Targets

    • Target

      PCS TENDER PROFILE-20210920.exe

    • Size

      24KB

    • MD5

      8475c4b32e4c24086dcef73a6c05fe3e

    • SHA1

      b36a3579be00a9b414ff8e34dd6e1d944214c0c3

    • SHA256

      a44ab6dc43269d5f7f13aefc084b0a4d463126eea8a3de38979b5f5f96ea6a8d

    • SHA512

      d3d0e1ef48432ca5351ea919e7fe99388ed941e128c82b937d6eb94bd91c00fca6784e7df99498de68ae0ce8352dfa266d316c4bbfa716abef31a69a4922646b

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • Modifies WinLogon for persistence

      persistence

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks