warzonerat | 70f71e4c4b73ce02b478c585ab4341246d77e7d5f58cd9950304dfd6a79709ec | Triage

Sharing

General

Target

681d6bf0153e7f32572f8593940653869e9ede7377afdad8e1ef88fa79abb7eeN.exe
Size

1.2MB
Sample

241112-e1th3averd
MD5

e9bec0edd48322ee42de8c0db0859b85
SHA1

e9c57cc59e32b7d39348e5ebeec55bb00f221639
SHA256

70f71e4c4b73ce02b478c585ab4341246d77e7d5f58cd9950304dfd6a79709ec
SHA512

68e0810ae50fc9b44b3ef99591866af97d15b80e291b6effdac176df5a9ee8951d2db3f71ccbae71364e1bcf13560bc1fdc072ad9463dedf3fab7205ce704275
SSDEEP

12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11kh:OIbGD2JTu0GoZQDbGV6eH81kh

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  681d6bf0153e7f32572f8593940653869e9ede7377afdad8e1ef88fa79abb7eeN.exe
- Size
  
  1.2MB
- MD5
  
  e9bec0edd48322ee42de8c0db0859b85
- SHA1
  
  e9c57cc59e32b7d39348e5ebeec55bb00f221639
- SHA256
  
  70f71e4c4b73ce02b478c585ab4341246d77e7d5f58cd9950304dfd6a79709ec
- SHA512
  
  68e0810ae50fc9b44b3ef99591866af97d15b80e291b6effdac176df5a9ee8951d2db3f71ccbae71364e1bcf13560bc1fdc072ad9463dedf3fab7205ce704275
- SSDEEP
  
  12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11kh:OIbGD2JTu0GoZQDbGV6eH81kh
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence