Overview

overview

10

Static

static

1

PRODUCTS I...28.exe

windows7-x64

10

PRODUCTS I...28.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    PRODUCTS INQUIRY 228.exe

  • Size

    1.0MB

  • Sample

    230404-vvwdgaaf9w

  • MD5

    aaa75ef6b31883aada3cbe14a3b000be

  • SHA1

    73aca3c4d320afe0ae23a71831d6cc5528ea6c71

  • SHA256

    4ec081f16baabe564b1038b86fe09f8b6fb3ef70a83abb23141e423fb36a42ec

  • SHA512

    5f34f8f142fc3d456468df9ed6a05e540af3eac13e10592470a552900b609b921f30d727f22c21a0959de7932c6c3dde6558833119739bb3457a4e183d142799

  • SSDEEP

    12288:VVmvSJR+u2NxZecauQFNV/7Md2kuhbV/VTpxE+22NNeT7gGpidVIcM3Uh664cYXC:+zloV5y1nsloHGgunvfD

Score
10/10
warzoneratcollectionevasioninfostealerpersistencerattrojan

Malware Config

Extracted

Family

warzonerat

C2

panchak.duckdns.org:5050

Targets

    • Target

      PRODUCTS INQUIRY 228.exe

    • Size

      1.0MB

    • MD5

      aaa75ef6b31883aada3cbe14a3b000be

    • SHA1

      73aca3c4d320afe0ae23a71831d6cc5528ea6c71

    • SHA256

      4ec081f16baabe564b1038b86fe09f8b6fb3ef70a83abb23141e423fb36a42ec

    • SHA512

      5f34f8f142fc3d456468df9ed6a05e540af3eac13e10592470a552900b609b921f30d727f22c21a0959de7932c6c3dde6558833119739bb3457a4e183d142799

    • SSDEEP

      12288:VVmvSJR+u2NxZecauQFNV/7Md2kuhbV/VTpxE+22NNeT7gGpidVIcM3Uh664cYXC:+zloV5y1nsloHGgunvfD

    Score
    10/10
    warzoneratevasioninfostealerpersistencerattrojancollection

    • UAC bypass

      evasiontrojan

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Windows security bypass

      evasiontrojan

    • Warzone RAT payload

      rat

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook profiles

      collection

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

5
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks