warzonerat | 81dd58f988ea27d5a30caa0d02b214709a07ebbee8245cd80bec6ece38a4102f | Triage

Sharing

General

Target

81dd58f988ea27d5a30caa0d02b214709a07ebbee8245cd80bec6ece38a4102f.exe
Size

2.8MB
Sample

241116-pgb5sawfrc
MD5

00f0f4289da07d281dd95b074f890c26
SHA1

c345d95626fe67dfdd3fe647d567b360b7915310
SHA256

81dd58f988ea27d5a30caa0d02b214709a07ebbee8245cd80bec6ece38a4102f
SHA512

23477e25cbd5c8425b23782b8ff6cf244d0cd1bea5af75f865a26901f248e1c74606788075d8e14fa6bada4281e85ff03075da2025cf1be22987e24c10dd0645
SSDEEP

24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHw:7v97AXmw4gxeOw46fUbNecCCFbNecz

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  81dd58f988ea27d5a30caa0d02b214709a07ebbee8245cd80bec6ece38a4102f.exe
- Size
  
  2.8MB
- MD5
  
  00f0f4289da07d281dd95b074f890c26
- SHA1
  
  c345d95626fe67dfdd3fe647d567b360b7915310
- SHA256
  
  81dd58f988ea27d5a30caa0d02b214709a07ebbee8245cd80bec6ece38a4102f
- SHA512
  
  23477e25cbd5c8425b23782b8ff6cf244d0cd1bea5af75f865a26901f248e1c74606788075d8e14fa6bada4281e85ff03075da2025cf1be22987e24c10dd0645
- SSDEEP
  
  24576:7v97AXmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHw:7v97AXmw4gxeOw46fUbNecCCFbNecz
Score

7^/10

discovery persistence
- Drops startup file
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence