Overview

overview

10

Static

static

satınalma...90.exe

windows7-x64

10

satınalma...90.exe

windows10-2004-x64

10

Resubmissions

29-11-2022 08:08

221129-j12xnabb58 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    satınalma siparişi 2310190.exe

  • Size

    400.0MB

  • Sample

    221129-j12xnabb58

  • MD5

    b9c62ad26109e6399a35b356b617f9bf

  • SHA1

    6a072c9b3ed98f1de2d78507243ec92a0f54bcb1

  • SHA256

    5017e949a8d2d34130e294840a09efaf5e2798f86a57d6d34e5f512fe9ae4daf

  • SHA512

    3d6904a769ed9c1de2728082759773d26bf6767cf4c8e1b04f39364cbf11f2d34ab8bea17fc48ce23480d8e2b3e4c6a8c2956097321bd86b7260c759294aadb5

  • SSDEEP

    384:IaRWJcgLYn79k8/mf7E++ptYcFmVc03K9t:UckU79k8mTKtYcFmVc6Kf

Score
10/10
warzoneratcollectioninfostealerpersistenceratspywarestealer

Malware Config

Targets

    • Target

      satınalma siparişi 2310190.exe

    • Size

      400.0MB

    • MD5

      b9c62ad26109e6399a35b356b617f9bf

    • SHA1

      6a072c9b3ed98f1de2d78507243ec92a0f54bcb1

    • SHA256

      5017e949a8d2d34130e294840a09efaf5e2798f86a57d6d34e5f512fe9ae4daf

    • SHA512

      3d6904a769ed9c1de2728082759773d26bf6767cf4c8e1b04f39364cbf11f2d34ab8bea17fc48ce23480d8e2b3e4c6a8c2956097321bd86b7260c759294aadb5

    • SSDEEP

      384:IaRWJcgLYn79k8/mf7E++ptYcFmVc03K9t:UckU79k8mTKtYcFmVc6Kf

    Score
    10/10
    warzoneratinfostealerpersistenceratspywarestealercollection

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks