warzonerat | 9798d52fcefdb686c71d02a095ddf3a142c75377249f29e7a65abff4209d1fc3 | Triage

Sharing

General

Target

9798d52fcefdb686c71d02a095ddf3a142c75377249f29e7a65abff4209d1fc3.exe
Size

2.9MB
Sample

241111-1b5exsxbkr
MD5

6fb3dd5d48c43211f769cce336e40ab2
SHA1

c96ad7a10464ed8c39a703ca4248b861270f958d
SHA256

9798d52fcefdb686c71d02a095ddf3a142c75377249f29e7a65abff4209d1fc3
SHA512

03e146b28426860f692f202fcc82a660f14c9fc8c0b849f581f8b0e377deab0afb02ff5d0ac47b574b648d01b578cc858c2ba39f7d8dae9666df042f60d2ad15
SSDEEP

24576:eTy7ASmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHl:eTy7ASmw4gxeOw46fUbNecCCFbNecg

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  9798d52fcefdb686c71d02a095ddf3a142c75377249f29e7a65abff4209d1fc3.exe
- Size
  
  2.9MB
- MD5
  
  6fb3dd5d48c43211f769cce336e40ab2
- SHA1
  
  c96ad7a10464ed8c39a703ca4248b861270f958d
- SHA256
  
  9798d52fcefdb686c71d02a095ddf3a142c75377249f29e7a65abff4209d1fc3
- SHA512
  
  03e146b28426860f692f202fcc82a660f14c9fc8c0b849f581f8b0e377deab0afb02ff5d0ac47b574b648d01b578cc858c2ba39f7d8dae9666df042f60d2ad15
- SSDEEP
  
  24576:eTy7ASmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHl:eTy7ASmw4gxeOw46fUbNecCCFbNecg
Score

7^/10

discovery persistence
- Drops startup file
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence