General

  • Target

    3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f.zip

  • Size

    251KB

  • Sample

    230321-rv4hasda7w

  • MD5

    2041f02f89550f405731a875cd6c5e99

  • SHA1

    0e27b3debb67eb4797f7d342fc3f97dd6af3547f

  • SHA256

    eaa78596969aa1b58dcc9365e7c3b14997ea08fe9a9d4615e940f64d18e002d8

  • SHA512

    1c5c3cae45cd7a90d1f3224ab7e8e39635e9e05fa14ad81a829f26aa9c9aacd486987883a819983c90c5d3c3e0cf2c4a6151366b14c471409bb9eaa60a7137c9

  • SSDEEP

    6144:XAAVmGTDtHUE1/BMhd+euk+UTSxkkvQosr5F:XAATXt0mZ0dTvTkor

Malware Config

Extracted

Family

warzonerat

C2

dnmpbczm0963fxtdplc.duckdns.org:5689

Targets

    • Target

      3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f.exe

    • Size

      267KB

    • MD5

      4dbe71a4ca0eaea634ec73b4a82d32a9

    • SHA1

      48ba9c1be52988de95bf1a2597fd573f96892895

    • SHA256

      3abea4ab1fa4c8497722e9b58c5981fbc90fefe5a1d0bda707bdabfe3c1bdb1f

    • SHA512

      5f157e987b2c2b25a2d66e49dcc583220da474bd8756b6ea8d206ebeb99e994a02f98800a081a750b885b576f20204b89b8632de956bf0d8cec9d5785c6fcd70

    • SSDEEP

      6144:GDOmbbC0309OSXjr2Z2UCEVSOuzAtf/QZv3z9jnnOldiUf:4bZ309//2HCEVNuzaf/QZvj1nki

    • Guloader,Cloudeye

      A shellcode based downloader first seen in 2020.

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Checks QEMU agent file

      Checks presence of QEMU agent, possibly to detect virtualization.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    • Suspicious use of NtCreateThreadExHideFromDebugger

    • Suspicious use of NtSetInformationThreadHideFromDebugger

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Tasks