Overview

overview

10

Static

static

1

4ec081f16b...ec.exe

windows7-x64

10

4ec081f16b...ec.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aaa75ef6b31883aada3cbe14a3b000be.bin

  • Size

    475KB

  • Sample

    230406-b9gdbacg4z

  • MD5

    75b85b154a0706717776c904db4b63c5

  • SHA1

    1653bf78ce81ab68ae8f61ac9184d0e8610a4db5

  • SHA256

    04238e3f267b2e1c7b6393bc3f21eaee2374d77a81c096c475339732772d1259

  • SHA512

    1566a6810e3d18316152b1cd241e582480c17625450feae8cddf0aa13984630c3e8e770ae8c2a4ee2a0648348d0b3c1258cf3e316fb75a8b2d28d65f3788396c

  • SSDEEP

    12288:r0LaDoBQNeRAZ0zyWlpz2gSpl3Bb/5WRVwi3:cFY+AZ07Dz2geJoRVD3

Score
10/10
warzoneratcollectionevasioninfostealerpersistencerattrojan

Malware Config

Extracted

Family

warzonerat

C2

panchak.duckdns.org:5050

Targets

    • Target

      4ec081f16baabe564b1038b86fe09f8b6fb3ef70a83abb23141e423fb36a42ec.exe

    • Size

      1.0MB

    • MD5

      aaa75ef6b31883aada3cbe14a3b000be

    • SHA1

      73aca3c4d320afe0ae23a71831d6cc5528ea6c71

    • SHA256

      4ec081f16baabe564b1038b86fe09f8b6fb3ef70a83abb23141e423fb36a42ec

    • SHA512

      5f34f8f142fc3d456468df9ed6a05e540af3eac13e10592470a552900b609b921f30d727f22c21a0959de7932c6c3dde6558833119739bb3457a4e183d142799

    • SSDEEP

      12288:VVmvSJR+u2NxZecauQFNV/7Md2kuhbV/VTpxE+22NNeT7gGpidVIcM3Uh664cYXC:+zloV5y1nsloHGgunvfD

    Score
    10/10
    warzoneratcollectionevasioninfostealerpersistencerattrojan

    • UAC bypass

      evasiontrojan

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Windows security bypass

      evasiontrojan

    • Warzone RAT payload

      rat

    • Sets service image path in registry

      persistence

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Windows security modification

      evasiontrojan

    • Accesses Microsoft Outlook profiles

      collection

    • Checks whether UAC is enabled

      evasiontrojan

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Bypass User Account Control

1
T1088

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

3
T1089

Modify Registry

5
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks