Overview

overview

10

Static

static

3

Bank Copy.exe

windows7-x64

10

Bank Copy.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6cbd5ed6f4fd08e4e967f7ecad37f5a0_JaffaCakes118

  • Size

    370KB

  • Sample

    240524-agcnzsed95

  • MD5

    6cbd5ed6f4fd08e4e967f7ecad37f5a0

  • SHA1

    7f34da3920f6248f3e46a71f3cf7eb07f5c65c5f

  • SHA256

    e4a09df65e6fa5f2503ee3f5d70ca01ce70242ad5483c321ccd7ffe9ea885519

  • SHA512

    f840f04a0e6ebb7c5ed31d0d59fd590c73f3dc568194b78d88b74dcb26e28859f64e5c4dbfb060317c099d34ff2972be63cac5dd6ccff160333eb11da2bb142f

  • SSDEEP

    6144:YHYE9ZtsDPmdnTD54OW5pvOfUuNFi0wITUGydwr6yPwWhWAMFmr:Y4NjmdpgppuaCYVwrdP06

Score
10/10
warzoneratexecutioninfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

191.101.193.159:3800

Targets

    • Target

      Bank Copy.exe

    • Size

      523KB

    • MD5

      a5bcd2c4a412ec6662a2ad9246ef5f57

    • SHA1

      d600171e802bf1af82cd5a88484b84787738fe2a

    • SHA256

      44631c28fe04318faf429139fae5d95554dc1a9c4fd47b2c2ab2e0fff7667271

    • SHA512

      46e94d7cc180c3141dcb0899e7f67f9ac7d0ffd6a35cd32a62648b5f3b5c2de127495c12683a5fe77f26b9eb435464d38e645625ca70959fcdb724359ac16950

    • SSDEEP

      12288:e++r1s0nfkxL8UGPpzgCmqqCt/b7ejl2:eRr1s0VR7mG/el2

    Score
    10/10
    warzoneratinfostealerratexecutionpersistence

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks