General

  • Target

    0ffeab62900e5c6a8ad0758cb88fb684798df3d14dc76563cff8fc41687ad659.exe

  • Size

    797KB

  • Sample

    230323-cf5z9aeg8w

  • MD5

    0144ace487120c3c08fa6a24b0ece3c9

  • SHA1

    289ac160d0c978b1ee898ca5a7da11225236d388

  • SHA256

    0ffeab62900e5c6a8ad0758cb88fb684798df3d14dc76563cff8fc41687ad659

  • SHA512

    d5eef02c64db4a4cdec829e52de2865d4e2a74413790fab58355a4902499664a070929ab4a7265c77f845045fc02d865ec26175a1f55d7cf47d0082367aad6b9

  • SSDEEP

    24576:tiSuYTsIBMNjnNNOhAe/S0L4JpctxmwwQVxDphOqy5nC:0HJiKqThOP5

Malware Config

Extracted

Family

warzonerat

C2

79.134.225.88:5555

Targets

    • Target

      0ffeab62900e5c6a8ad0758cb88fb684798df3d14dc76563cff8fc41687ad659.exe

    • Size

      797KB

    • MD5

      0144ace487120c3c08fa6a24b0ece3c9

    • SHA1

      289ac160d0c978b1ee898ca5a7da11225236d388

    • SHA256

      0ffeab62900e5c6a8ad0758cb88fb684798df3d14dc76563cff8fc41687ad659

    • SHA512

      d5eef02c64db4a4cdec829e52de2865d4e2a74413790fab58355a4902499664a070929ab4a7265c77f845045fc02d865ec26175a1f55d7cf47d0082367aad6b9

    • SSDEEP

      24576:tiSuYTsIBMNjnNNOhAe/S0L4JpctxmwwQVxDphOqy5nC:0HJiKqThOP5

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Tasks