Overview

overview

10

Static

static

SOA & UNPA...df.exe

windows7_x64

3

SOA & UNPA...df.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SOA & UNPAID INVOICES.pdf.exe

  • Size

    670KB

  • Sample

    220521-g4wtpsaec6

  • MD5

    b6e3ea3ca41fadf4b2d8e8c4547bbb3b

  • SHA1

    dbd634b213e1dba07b9d3cb4b880d2db158818f7

  • SHA256

    a9e823696e9c25dda75eae39878e430238e78b379bb51a0658d8fd93bd2c604d

  • SHA512

    ecc6d1b83eada0530986c3357a56b51253686bc3db150601daf8cca0dce4db0349a4ec75bb702c808aee2c5618bdb120d8ba249b20fa9426d6983f7d4516fa29

Score
10/10
warzoneratcollectioninfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

76.8.53.133:1198

Targets

    • Target

      SOA & UNPAID INVOICES.pdf.exe

    • Size

      670KB

    • MD5

      b6e3ea3ca41fadf4b2d8e8c4547bbb3b

    • SHA1

      dbd634b213e1dba07b9d3cb4b880d2db158818f7

    • SHA256

      a9e823696e9c25dda75eae39878e430238e78b379bb51a0658d8fd93bd2c604d

    • SHA512

      ecc6d1b83eada0530986c3357a56b51253686bc3db150601daf8cca0dce4db0349a4ec75bb702c808aee2c5618bdb120d8ba249b20fa9426d6983f7d4516fa29

    Score
    10/10
    warzoneratcollectioninfostealerpersistenceratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT Payload

      rat

    • Sets DLL path for service in the registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Winlogon Helper DLL

1
T1004

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks