General

  • Target

    b5940caa2bb500680f0fee56d5d09de0.exe

  • Size

    703KB

  • Sample

    230421-p6y1vahd91

  • MD5

    b5940caa2bb500680f0fee56d5d09de0

  • SHA1

    c8794e4ddb4e26c3459bc971d8ed602f2d3f3886

  • SHA256

    55b7f1bd4c56855427d9f9cec42bc93f75995193f023f4242b7f6e958868f619

  • SHA512

    ec3b0fcf8fc00ff05e35d456eaea8cf92706cc5bba3f0604c847b516ceca2c107ff46d2d6d74a3bfd37df26e686c561a4a29e8e9c23d5d4480715342227fc5e9

  • SSDEEP

    12288:gkI303av+MZO0bfKIosoFwewOPyaEzjOol:gkGv+MZOxpFLwOaaEvO

Malware Config

Extracted

Family

warzonerat

C2

emberluck.duckdns.org:5200

Targets

    • Target

      b5940caa2bb500680f0fee56d5d09de0.exe

    • Size

      703KB

    • MD5

      b5940caa2bb500680f0fee56d5d09de0

    • SHA1

      c8794e4ddb4e26c3459bc971d8ed602f2d3f3886

    • SHA256

      55b7f1bd4c56855427d9f9cec42bc93f75995193f023f4242b7f6e958868f619

    • SHA512

      ec3b0fcf8fc00ff05e35d456eaea8cf92706cc5bba3f0604c847b516ceca2c107ff46d2d6d74a3bfd37df26e686c561a4a29e8e9c23d5d4480715342227fc5e9

    • SSDEEP

      12288:gkI303av+MZO0bfKIosoFwewOPyaEzjOol:gkGv+MZOxpFLwOaaEvO

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

    • ModiLoader Second Stage

    • Warzone RAT payload

    • Executes dropped EXE

    • Loads dropped DLL

    • Accesses Microsoft Outlook profiles

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks