Overview

overview

10

Static

static

Kyodo Inte...ts.exe

windows7_x64

10

Kyodo Inte...ts.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Kyodo International Corp - Products Lists.exe

  • Size

    500KB

  • Sample

    211018-enj4vsdag4

  • MD5

    dedf943ff806b843bfbf70f482043abb

  • SHA1

    c18cf743fb7e0547fbc6076e3afb87ef1abb177f

  • SHA256

    20c946eadf8195d4d6c9b6634f7f8cfa56cb8e8423a37517556a30ee0aadc053

  • SHA512

    58eb8e1184bb73cf4980fbda41eb2cc9dce26a1d858f1d3d692789853a9cabe1a5d9e77d3853baed926a96e03536394b4204db40746d4f353baf84401296d78d

Score
10/10
warzoneratcollectioninfostealerratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

185.222.57.253:4782

Targets

    • Target

      Kyodo International Corp - Products Lists.exe

    • Size

      500KB

    • MD5

      dedf943ff806b843bfbf70f482043abb

    • SHA1

      c18cf743fb7e0547fbc6076e3afb87ef1abb177f

    • SHA256

      20c946eadf8195d4d6c9b6634f7f8cfa56cb8e8423a37517556a30ee0aadc053

    • SHA512

      58eb8e1184bb73cf4980fbda41eb2cc9dce26a1d858f1d3d692789853a9cabe1a5d9e77d3853baed926a96e03536394b4204db40746d4f353baf84401296d78d

    Score
    10/10
    warzoneratcollectioninfostealerratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks