Overview

overview

10

Static

static

1

irs no 293...87.exe

windows7-x64

10

irs no 293...87.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    irs no 2931F?YAT ?STEM? HK. - 285387.exe

  • Size

    535KB

  • Sample

    230406-hs9f4abh55

  • MD5

    5ccf7ffa4a0613c3bca058badb2a506e

  • SHA1

    89f5fc5f463582d4b74b86cb716b3f6c98eef018

  • SHA256

    83feaa7f117937d31019d3ec4833e4a7080c26d807de62556c5ee08d4f00ba72

  • SHA512

    91a99238f9993b1eb721df680120750e295717bfc9d1c64dc6f3778744d74d5e29bcbe27553902048ae01c524babf2322a266a7dff00107be72935a358216069

  • SSDEEP

    12288:RP9RcweXsub99E/osSqpCJABBzDnnFyo:7YPYosPBnF

Score
10/10
warzoneratcollectioninfostealerpersistenceratspywarestealer

Malware Config

Extracted

Family

warzonerat

C2

kellerwarzone.ddns.net:5200

Targets

    • Target

      irs no 2931F?YAT ?STEM? HK. - 285387.exe

    • Size

      535KB

    • MD5

      5ccf7ffa4a0613c3bca058badb2a506e

    • SHA1

      89f5fc5f463582d4b74b86cb716b3f6c98eef018

    • SHA256

      83feaa7f117937d31019d3ec4833e4a7080c26d807de62556c5ee08d4f00ba72

    • SHA512

      91a99238f9993b1eb721df680120750e295717bfc9d1c64dc6f3778744d74d5e29bcbe27553902048ae01c524babf2322a266a7dff00107be72935a358216069

    • SSDEEP

      12288:RP9RcweXsub99E/osSqpCJABBzDnnFyo:7YPYosPBnF

    Score
    10/10
    warzoneratcollectioninfostealerpersistenceratspywarestealer

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Lateral Movement

Collection

Data from Local System

1
T1005

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks