General

  • Target

    SecuriteInfo.com.Win32.DropperX-gen.9148.20800.exe

  • Size

    1.0MB

  • Sample

    221129-s9bw9sch68

  • MD5

    373574c70ab6f299813fdafa9c12ab9b

  • SHA1

    e6dbfbbe58f87e70da25f5cd31e526ddbceb679e

  • SHA256

    ad8184627690f50da83d52fa3b92ed2597e279527821ffdede20240d19cc3e21

  • SHA512

    4ec3f08aa83db8fedf0aca9f0fdcb3237afc35f34ba1adee6f3372d4aec2b544db5bb892e49f8c8a00a82c10c8ba697ff21d161d44f7695a1eac132c190e3dd5

  • SSDEEP

    24576:fWOJrKG6vIyZCx67yqfQC40xquBsdq8Uz7REU4R9:fWOz6wyU6ML0dsdq8UJB4

Malware Config

Extracted

Family

warzonerat

C2

62.102.148.158:62641

Targets

    • Target

      SecuriteInfo.com.Win32.DropperX-gen.9148.20800.exe

    • Size

      1.0MB

    • MD5

      373574c70ab6f299813fdafa9c12ab9b

    • SHA1

      e6dbfbbe58f87e70da25f5cd31e526ddbceb679e

    • SHA256

      ad8184627690f50da83d52fa3b92ed2597e279527821ffdede20240d19cc3e21

    • SHA512

      4ec3f08aa83db8fedf0aca9f0fdcb3237afc35f34ba1adee6f3372d4aec2b544db5bb892e49f8c8a00a82c10c8ba697ff21d161d44f7695a1eac132c190e3dd5

    • SSDEEP

      24576:fWOJrKG6vIyZCx67yqfQC40xquBsdq8Uz7REU4R9:fWOz6wyU6ML0dsdq8UJB4

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Command-Line Interface

1
T1059

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

2
T1112

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks