Overview

overview

10

Static

static

1

b5940caa2b...e0.exe

windows7-x64

10

b5940caa2b...e0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5940caa2bb500680f0fee56d5d09de0.exe

  • Size

    703KB

  • Sample

    230421-p6b63sff32

  • MD5

    b5940caa2bb500680f0fee56d5d09de0

  • SHA1

    c8794e4ddb4e26c3459bc971d8ed602f2d3f3886

  • SHA256

    55b7f1bd4c56855427d9f9cec42bc93f75995193f023f4242b7f6e958868f619

  • SHA512

    ec3b0fcf8fc00ff05e35d456eaea8cf92706cc5bba3f0604c847b516ceca2c107ff46d2d6d74a3bfd37df26e686c561a4a29e8e9c23d5d4480715342227fc5e9

  • SSDEEP

    12288:gkI303av+MZO0bfKIosoFwewOPyaEzjOol:gkGv+MZOxpFLwOaaEvO

Score
10/10
modiloaderwarzoneratcollectioninfostealerpersistencerattrojan

Malware Config

Extracted

Family

warzonerat

C2

emberluck.duckdns.org:5200

Targets

    • Target

      b5940caa2bb500680f0fee56d5d09de0.exe

    • Size

      703KB

    • MD5

      b5940caa2bb500680f0fee56d5d09de0

    • SHA1

      c8794e4ddb4e26c3459bc971d8ed602f2d3f3886

    • SHA256

      55b7f1bd4c56855427d9f9cec42bc93f75995193f023f4242b7f6e958868f619

    • SHA512

      ec3b0fcf8fc00ff05e35d456eaea8cf92706cc5bba3f0604c847b516ceca2c107ff46d2d6d74a3bfd37df26e686c561a4a29e8e9c23d5d4480715342227fc5e9

    • SSDEEP

      12288:gkI303av+MZO0bfKIosoFwewOPyaEzjOol:gkGv+MZOxpFLwOaaEvO

    Score
    10/10
    modiloadertrojanwarzoneratcollectioninfostealerpersistencerat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • ModiLoader Second Stage

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

      collection

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Email Collection

1
T1114

Exfiltration

Command and Control

Impact

Tasks