Overview

overview

10

Static

static

f23cee6cf6...2b.exe

windows7_x64

10

f23cee6cf6...2b.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f23cee6cf6de2de9b3d570a7f017c22b.exe

  • Size

    1.0MB

  • Sample

    220407-qqhjlagga6

  • MD5

    f23cee6cf6de2de9b3d570a7f017c22b

  • SHA1

    12b26e966bdb8e29734597d210c54d19509dbff8

  • SHA256

    b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44

  • SHA512

    56465532903563e248ccfe2ffdee198e1b967b65d99f7c977bb7e65e84330acc1273afcb119b55c147ebb22a0588e8855e604d0a54c335096efb265308f18586

Score
10/10
modiloaderwarzoneratcollectioninfostealerpersistencerattrojan

Malware Config

Extracted

Family

warzonerat

C2

nweke.ddnsgeek.com:6746

Targets

    • Target

      f23cee6cf6de2de9b3d570a7f017c22b.exe

    • Size

      1.0MB

    • MD5

      f23cee6cf6de2de9b3d570a7f017c22b

    • SHA1

      12b26e966bdb8e29734597d210c54d19509dbff8

    • SHA256

      b931f34008a112398ad48f0bd4e2e955dd7385bcc5cafd41cdb2220f26bddc44

    • SHA512

      56465532903563e248ccfe2ffdee198e1b967b65d99f7c977bb7e65e84330acc1273afcb119b55c147ebb22a0588e8855e604d0a54c335096efb265308f18586

    Score
    10/10
    modiloaderpersistencetrojanwarzoneratcollectioninfostealerrat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks