General

  • Target

    fee808b6925140d071f085c8a4f9932cbf49b8bee46a08d7fbdedf5f3c90c343.exe

  • Size

    54KB

  • Sample

    230227-lshvxscg5x

  • MD5

    9aacc7fe39f97acd57eb80b17d1fb3af

  • SHA1

    619ea82f536fea74ed7fbd493802e69abda5e64e

  • SHA256

    fee808b6925140d071f085c8a4f9932cbf49b8bee46a08d7fbdedf5f3c90c343

  • SHA512

    4c50bb02fbb07233a33235ac2dc12b483bc97374c8b90968b922c059602b6c2bab4ec93f5ec6865108b959fb59c70bcb734b4b7117d71dd47086e6af26244df3

  • SSDEEP

    768:sh/B6j+CBY3GFsj13K7HV0z0tO/gdY2noLbaZQv+dfCfAJLKlMXm4ICNUTSRoHKW:eAF9wMzfecV+T8u5

Malware Config

Extracted

Family

warzonerat

C2

91.193.75.238:9974

Targets

    • Target

      fee808b6925140d071f085c8a4f9932cbf49b8bee46a08d7fbdedf5f3c90c343.exe

    • Size

      54KB

    • MD5

      9aacc7fe39f97acd57eb80b17d1fb3af

    • SHA1

      619ea82f536fea74ed7fbd493802e69abda5e64e

    • SHA256

      fee808b6925140d071f085c8a4f9932cbf49b8bee46a08d7fbdedf5f3c90c343

    • SHA512

      4c50bb02fbb07233a33235ac2dc12b483bc97374c8b90968b922c059602b6c2bab4ec93f5ec6865108b959fb59c70bcb734b4b7117d71dd47086e6af26244df3

    • SSDEEP

      768:sh/B6j+CBY3GFsj13K7HV0z0tO/gdY2noLbaZQv+dfCfAJLKlMXm4ICNUTSRoHKW:eAF9wMzfecV+T8u5

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Modifies Windows Firewall

    • Sets DLL path for service in the registry

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Accesses Microsoft Outlook profiles

    • Modifies WinLogon

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks