warzonerat | b216385f4b673f00a9f3627eb4d19499fe88b63d62fded2d0d5c38ca3e495988 | Triage

Sharing

General

Target

b216385f4b673f00a9f3627eb4d19499fe88b63d62fded2d0d5c38ca3e495988.exe
Size

1.2MB
Sample

241114-gpftyavjg1
MD5

25785d11ea1c9c21ac0573fe0c93e9e3
SHA1

4b98febd83cd066d2e991b176ee7c6e0b5e9ded6
SHA256

b216385f4b673f00a9f3627eb4d19499fe88b63d62fded2d0d5c38ca3e495988
SHA512

3f6b42266ca26ad50ee0218eb1c0f33101deaf5da207e70cee738350b04d3251d3a6baff5881e6076193374df12fc626189fc3b459c6fa4474f2527c4ba40eb8
SSDEEP

12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ko:OIbGD2JTu0GoZQDbGV6eH81ko

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  b216385f4b673f00a9f3627eb4d19499fe88b63d62fded2d0d5c38ca3e495988.exe
- Size
  
  1.2MB
- MD5
  
  25785d11ea1c9c21ac0573fe0c93e9e3
- SHA1
  
  4b98febd83cd066d2e991b176ee7c6e0b5e9ded6
- SHA256
  
  b216385f4b673f00a9f3627eb4d19499fe88b63d62fded2d0d5c38ca3e495988
- SHA512
  
  3f6b42266ca26ad50ee0218eb1c0f33101deaf5da207e70cee738350b04d3251d3a6baff5881e6076193374df12fc626189fc3b459c6fa4474f2527c4ba40eb8
- SSDEEP
  
  12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ko:OIbGD2JTu0GoZQDbGV6eH81ko
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence