Overview

overview

10

Static

static

PO ZY-ZXM-...01.exe

windows7-x64

10

PO ZY-ZXM-...01.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PO ZY-ZXM-2022092901.exe

  • Size

    1.2MB

  • Sample

    221003-p3l7wagbb4

  • MD5

    cd80d0f61ce16ec77002bfdfb32e1cd1

  • SHA1

    d592a9e682a19d01cd67b719b74221bae1071b98

  • SHA256

    8a7d33c94d5d7397864ac2bb01102f95627beb25d5c9cbed9d975ad390302f38

  • SHA512

    888a2341ddbabd30aed988006880b004d1c69a7a54daac2418ffe3d8aa2aa7fc478fb712ad15fa4135dbe82f2028c9040125d09378b87365f341be48f0a99866

  • SSDEEP

    24576:oS9QeAnN+9wHsOzj4j85M1hUQDAxzJX44+ZjgL:oS9oDsOzj4jGM1aK4FXC

Score
10/10
remcoswarzoneratremotehostcollectionevasioninfostealerpersistencerat

Malware Config

Extracted

Family

remcos

Botnet

RemoteHost

C2

harjahwool.ddnsfree.com:8372

Attributes
  • audio_folder

    MicRecords

  • audio_path

    ApplicationPath

  • audio_record_time

    5

  • connect_delay

    0

  • connect_interval

    1

  • copy_file

    remcos.exe

  • copy_folder

    Remcos

  • delete_file

    false

  • hide_file

    false

  • hide_keylog_file

    false

  • install_flag

    false

  • keylog_crypt

    true

  • keylog_file

    logs.dat

  • keylog_flag

    false

  • keylog_folder

    remcos

  • mouse_option

    false

  • mutex

    Rmc-EGNT8M

  • screenshot_crypt

    true

  • screenshot_flag

    true

  • screenshot_folder

    Screenshots

  • screenshot_path

    %AppData%

  • screenshot_time

    10

  • startup_value

    Remcos

  • take_screenshot_option

    false

  • take_screenshot_time

    5

Extracted

Family

warzonerat

C2

harjahwool.ddnsfree.com:2309

Targets

    • Target

      PO ZY-ZXM-2022092901.exe

    • Size

      1.2MB

    • MD5

      cd80d0f61ce16ec77002bfdfb32e1cd1

    • SHA1

      d592a9e682a19d01cd67b719b74221bae1071b98

    • SHA256

      8a7d33c94d5d7397864ac2bb01102f95627beb25d5c9cbed9d975ad390302f38

    • SHA512

      888a2341ddbabd30aed988006880b004d1c69a7a54daac2418ffe3d8aa2aa7fc478fb712ad15fa4135dbe82f2028c9040125d09378b87365f341be48f0a99866

    • SSDEEP

      24576:oS9QeAnN+9wHsOzj4j85M1hUQDAxzJX44+ZjgL:oS9oDsOzj4jGM1aK4FXC

    Score
    10/10
    remcosremotehostcollectionevasionpersistenceratwarzoneratinfostealer

    • Modifies WinLogon for persistence

      persistence

    • Remcos

      Remcos is a closed-source remote control and surveillance software.

      ratremcos

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • NirSoft MailPassView

      Password recovery tool for various email clients

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Stops running service(s)

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Accesses Microsoft Outlook accounts

      collection

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Winlogon Helper DLL

1
T1004

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Impair Defenses

1
T1562

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks