General

  • Target

    9fcf0a498b86fc20af3cc28a984135f0cc202f6577af79f96ec63ca6cb227c3c.zip

  • Size

    640KB

  • Sample

    230321-qpl6dsae39

  • MD5

    cf713c88bfb27d05c6ba7765e89b92ec

  • SHA1

    e44743e71a60f2c01b9cb796d2399de874f47c45

  • SHA256

    e97c20acfd079fb64e248036f1090aa351fdc48b94c41296e7e20abddac45584

  • SHA512

    9321cab21056df57bc2eb5bbd98e78c3641c7a3e68901c27a1dcbc892dc0e4139cdf7c7a1742cf09b43b90c400e972d222c7fd15a1d2086af4a4df326b8ccdb2

  • SSDEEP

    12288:9OiCBsyxowS5Nj3nyb5sMn0WDO/ltbmgk6q59+fxLB87MsJcrFcyJi1fpSn797:9OVsyybLyjPOtFmg3q59+pL67ncrF1JP

Malware Config

Extracted

Family

warzonerat

C2

panchak.duckdns.org:5050

Targets

    • Target

      9fcf0a498b86fc20af3cc28a984135f0cc202f6577af79f96ec63ca6cb227c3c.exe

    • Size

      845KB

    • MD5

      c3c291b38d054d5e71fe17a10d737249

    • SHA1

      86411ff9d41eb140c80753873b943d80be323130

    • SHA256

      9fcf0a498b86fc20af3cc28a984135f0cc202f6577af79f96ec63ca6cb227c3c

    • SHA512

      3b1b4f937b51d6bef403e44cc4b92ab52c0c5e2b7b503aea46030e9f5f058f77a5b9266c24565bfe18671e666b701c097dac3df089621ec8572f277415f2cdf6

    • SSDEEP

      12288:2nmIb3fNeH++znVXoW87FqKqi13U3mWxw7DG0mCuT7Yeg4firr:2m03fY+WnVX18BqBAU3e5mnn3

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Accesses Microsoft Outlook profiles

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Tasks