Overview

overview

10

Static

static

3

913377afa6...b3.exe

windows7-x64

10

913377afa6...b3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    dbd4d984eec4de76537fce169334327bf18008387bf4708945a47bf5b1e744d7

  • Size

    407KB

  • Sample

    240417-r1syradh6y

  • MD5

    5314d7afc4c67da1fd8aee97c7b8d70a

  • SHA1

    f6a7c5c434013988614339d0d329819392e59d24

  • SHA256

    dbd4d984eec4de76537fce169334327bf18008387bf4708945a47bf5b1e744d7

  • SHA512

    0adf6b297760f2aa5082fa83e0ef4f1d29be9acb03a2c12852eefbbfd7aa8af31ca65e03a107955507f216b5b792e222e1a782446e81ce0e0b143da1ebefb0f9

  • SSDEEP

    12288:vX4t4Ehlen6OScj2zHEdk9XOMmFBN+Jc5swvvp+iP:/qO6/nzH8k9+TFBN6cmSvp+iP

Score
10/10
warzoneratinfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

satgobleien.jumpingcrab.com:5201

Targets

    • Target

      913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3.exe

    • Size

      582KB

    • MD5

      7bee43d88ddd5717c4059960d4f7abbb

    • SHA1

      51768285fb6047a523af3d28e3e8601fa17a181d

    • SHA256

      913377afa6c3d7afb49a491f830d52a33353349819f0e91157a01dc8336ac5b3

    • SHA512

      b3043c68445d95d1794e6557d9ce096c812c631e7d43dcdfe40850731e94ed877799fd6baf162197c888d0484a07b9c8c73994b08c9844434d3f388b768162cd

    • SSDEEP

      12288:nSQ3xl2I6NRNXDrI9GeZnbfPJJgR5lbULc1tBWpK9s3FqFLtomQ:Bf6rNX1eVXjGbt1oqFLtoN

    Score
    10/10
    warzoneratinfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks