WarzoneRAT

Malware & Tools · WarzoneRAT

· MalwareS0670 · Zararlı Yazılım

Type

malware

Techniques

Used By

3 groups

Platforms

Windows

Description

WarzoneRAT is a malware-as-a-service remote access tool (RAT) written in C++ that has been publicly available for purchase since at least late 2018.(Citation: Check Point Warzone Feb 2020)(Citation: Uptycs Warzone UAC Bypass November 2020)

Tactic Coverage

stealth (6)privilege escalation (4)execution (4)command and control (4)collection (3)discovery (3)persistence (3)lateral movement (2)credential access (2)defense impairment (2)exfiltration (1)initial access (1)

Used By (3 groups)

G0142ConfuciusConfucius APT G1015Scattered SpiderRoasted 0ktapus, Octo Tempest G1018TA2541

Techniques (30)

T1005Data from Local System

collection

T1014Rootkit

stealth

T1021.001Remote Desktop Protocol

lateral movement

T1021.005VNC

lateral movement

T1041Exfiltration Over C2 Channel

exfiltration

T1055Process Injection

stealthprivilege escalation

References

https://attack.mitre.org/software/S0670 https://research.checkpoint.com/2020/warzone-behind-the-enemy-lines/https://www.uptycs.com/blog/warzone-rat-comes-with-uac-bypass-technique

collectioncredential access

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1090Proxy

command and control

T1095Non-Application Layer Protocol

command and control

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1125Video Capture

collection

T1140Deobfuscate/Decode Files or Information

stealth

T1204.002Malicious File

execution

T1221Template Injection

stealth

T1546.015Component Object Model Hijacking

privilege escalationpersistence

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1548.002Bypass User Account Control

privilege escalation

T1555.003Credentials from Web Browsers

credential access

T1564Hide Artifacts

stealth

T1564.003Hidden Window

stealth

T1566.001Spearphishing Attachment

initial access

T1573.001Symmetric Cryptography

command and control

T1685Disable or Modify Tools

defense impairment