Overview

overview

10

Static

static

Receipt Or...if.exe

windows7-x64

7

Receipt Or...if.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Receipt Order No. 20803415.pif.exe

  • Size

    690KB

  • Sample

    221129-2zh29saf4s

  • MD5

    eaa51d8b99a1aa9d11ec05876ea2201f

  • SHA1

    f6d1ad0d23ea2a27181c7ad4f71a6155592ecd79

  • SHA256

    167d71a6a442391712d666ed3b072bf45e6208333d460c0a34d059321d06ef9f

  • SHA512

    ffb2f67d2f3bc922663bc65cbe83d59d428c0c328cb5313d53fb8edbd6f3f33c7b59b4808b80d61facde79ab5bf1c1343c0805bb1f8563797f66cf82c232aa3a

  • SSDEEP

    12288:xGmMZUFunCTZlpRvhKHf2mDoH63Av0ot4QUN24OG5:byU7fpOHn3Ak/g4O

Score
10/10
warzoneratcollectionevasioninfostealerpersistenceratspywarestealerupx

Malware Config

Extracted

Family

warzonerat

C2

91.121.228.166:5200

Targets

    • Target

      Receipt Order No. 20803415.pif.exe

    • Size

      690KB

    • MD5

      eaa51d8b99a1aa9d11ec05876ea2201f

    • SHA1

      f6d1ad0d23ea2a27181c7ad4f71a6155592ecd79

    • SHA256

      167d71a6a442391712d666ed3b072bf45e6208333d460c0a34d059321d06ef9f

    • SHA512

      ffb2f67d2f3bc922663bc65cbe83d59d428c0c328cb5313d53fb8edbd6f3f33c7b59b4808b80d61facde79ab5bf1c1343c0805bb1f8563797f66cf82c232aa3a

    • SSDEEP

      12288:xGmMZUFunCTZlpRvhKHf2mDoH63Av0ot4QUN24OG5:byU7fpOHn3Ak/g4O

    Score
    10/10
    warzoneratcollectionevasioninfostealerpersistenceratspywarestealerupx

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Sets DLL path for service in the registry

      persistence

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Modifies WinLogon

      persistence

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

2
T1060

Winlogon Helper DLL

1
T1004

Privilege Escalation

Defense Evasion

Modify Registry

3
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks