Overview

overview

10

Static

static

8

INV-30f434GTtrd.xlsm

windows7_x64

10

INV-30f434GTtrd.xlsm

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    INV-30f434GTtrd.xlsm

  • Size

    43KB

  • Sample

    211222-vah8eagdgn

  • MD5

    42f4b675b2f4b588a2af7a6aa9ec6c32

  • SHA1

    434eea6e1dcf12fb2a9d553df2af285913865838

  • SHA256

    cf4e53b7758ebb9a9470cb6fd3a2c69fcd96e045534ab80a44eac752c09e50f0

  • SHA512

    e52a2b8d03711f99a259a6680f3a689ce1583de7248e06585500f03437acb13b845d224ee299a848165b7ca14c362f9b5cc9ae6483fae96f574440e4c91b422a

Score
10/10
quasarwarzoneratsuccesscollectioninfostealermacropersistenceratspywarestealertrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
exe.dropper

https://marks397.co.za/FRE/MAEK.pif

Extracted

Family

warzonerat

C2

jerenyankipong.duckdns.org:5200

Extracted

Family

quasar

Version

1.3.0.0

Botnet

SUCCESS

C2

jerenyankipong.duckdns.org:4782

Mutex

MUTEX_jh9iPmixBt74IpSqEj

Attributes
  • encryption_key

    uO9yacYVMmi8921rParX

  • install_name

    Client.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    cmd

  • subdirectory

    SubDir

Targets

    • Target

      INV-30f434GTtrd.xlsm

    • Size

      43KB

    • MD5

      42f4b675b2f4b588a2af7a6aa9ec6c32

    • SHA1

      434eea6e1dcf12fb2a9d553df2af285913865838

    • SHA256

      cf4e53b7758ebb9a9470cb6fd3a2c69fcd96e045534ab80a44eac752c09e50f0

    • SHA512

      e52a2b8d03711f99a259a6680f3a689ce1583de7248e06585500f03437acb13b845d224ee299a848165b7ca14c362f9b5cc9ae6483fae96f574440e4c91b422a

    Score
    10/10
    quasarwarzoneratsuccesscollectioninfostealerpersistenceratspywarestealertrojan

    • Modifies WinLogon for persistence

      persistence

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Quasar Payload

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Nirsoft

    • Warzone RAT Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Deletes itself

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Winlogon Helper DLL

1
T1004

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks