Overview

overview

10

Static

static

1

Inq Form.xls.exe

windows7_x64

10

Inq Form.xls.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Inq Form.xls.zip

  • Size

    233KB

  • Sample

    211028-bx3e1sghc2

  • MD5

    95cee3c4a14ed4511b87129712072f61

  • SHA1

    cc20e0998ecadaa951a72e8a2933460cff01c32f

  • SHA256

    81c07da6f5f23512b16930ec072e5ec18183248039f10c4897cafe1324490986

  • SHA512

    1502e7e742fb83e53e64fead80677458e751432670fa0e479b80a918c99d6edaf67caa4448328fc17bcece262f293006ee16fdb804ea17ea679d6eb038779632

Score
10/10
warzoneratcollectioninfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

alliedofficewarz.ddns.net:6060

Targets

    • Target

      Inq Form.xls.exe

    • Size

      245KB

    • MD5

      4fcf859ac18a9562510e3ed11210340f

    • SHA1

      33e1fe0812598dbc752469f8b142a7988d83e7ea

    • SHA256

      8bd87aa08be3aebea3031d2ed817267f3b0a8272e39f396ae4ab4de256956455

    • SHA512

      5ce07cb3969a7a55dc310d30460aa5fc8f0400c2c216f45be1eb9bca874eafec8511a46b0e997ef6be0f7c68932838846e6756a195f6b44af4cc1272c232d789

    Score
    10/10
    warzoneratinfostealerratcollectionpersistencespywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks