warzonerat | cb77bf5485c6b3cacfa803214a09a0f4c84fa4716708d76bb1bd521ffbd8ac3d | Triage

Sharing

General

Target

cb77bf5485c6b3cacfa803214a09a0f4c84fa4716708d76bb1bd521ffbd8ac3d.exe
Size

8.9MB
Sample

241112-3rs3yawpgn
MD5

8a906f62ab2bb65293e44646ca3776f5
SHA1

327f569a330d316d417adf8f94c4cce081245b79
SHA256

cb77bf5485c6b3cacfa803214a09a0f4c84fa4716708d76bb1bd521ffbd8ac3d
SHA512

3f8f8aa2812aaf304de1662cbbde0dc80c48d1eb274ef819910c456c3567640a4c9c0f5e0608e2f559102b554202066922998e22015578a723d00dba52ed98bd
SSDEEP

49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecZ:K1+8e8e8f8e8e8a

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  cb77bf5485c6b3cacfa803214a09a0f4c84fa4716708d76bb1bd521ffbd8ac3d.exe
- Size
  
  8.9MB
- MD5
  
  8a906f62ab2bb65293e44646ca3776f5
- SHA1
  
  327f569a330d316d417adf8f94c4cce081245b79
- SHA256
  
  cb77bf5485c6b3cacfa803214a09a0f4c84fa4716708d76bb1bd521ffbd8ac3d
- SHA512
  
  3f8f8aa2812aaf304de1662cbbde0dc80c48d1eb274ef819910c456c3567640a4c9c0f5e0608e2f559102b554202066922998e22015578a723d00dba52ed98bd
- SSDEEP
  
  49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecZ:K1+8e8e8f8e8e8a
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence