Overview

overview

10

Static

static

10

2513cffce2...83.exe

windows7-x64

10

2513cffce2...83.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2513cffce280a80414825a1bd6232883.exe

  • Size

    132KB

  • Sample

    240727-dwbl1sxaph

  • MD5

    2513cffce280a80414825a1bd6232883

  • SHA1

    4534a043b96d31fcf6e79bf857db5ccffac31768

  • SHA256

    2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b

  • SHA512

    d65191709cd290256ba426c856cc7a7fa7cc2579458116f822a575681fe4117c97a91b088f8a19ba2352cacc7ab33cd7076ad13c55f8f3ec3d82b21e637028f9

  • SSDEEP

    3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

Score
10/10
warzoneratdiscoveryexecutioninfostealerpersistencerat

Malware Config

Extracted

Family

warzonerat

C2

142.202.242.177:5200

Targets

    • Target

      2513cffce280a80414825a1bd6232883.exe

    • Size

      132KB

    • MD5

      2513cffce280a80414825a1bd6232883

    • SHA1

      4534a043b96d31fcf6e79bf857db5ccffac31768

    • SHA256

      2769012a5682a98b6f68e4e50157077fef4dc0853654c68986837f17b1c6451b

    • SHA512

      d65191709cd290256ba426c856cc7a7fa7cc2579458116f822a575681fe4117c97a91b088f8a19ba2352cacc7ab33cd7076ad13c55f8f3ec3d82b21e637028f9

    • SSDEEP

      3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a

    Score
    10/10
    warzoneratdiscoveryexecutioninfostealerpersistencerat

    • WarzoneRat, AveMaria

      WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.

      ratinfostealerwarzonerat

    • Warzone RAT payload

      rat

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks