warzonerat | 2eeb366090643a685dc88b0578cb55d41b15d6dac618e83d0d518b2daf37a432 | Triage

Sharing

General

Target

2eeb366090643a685dc88b0578cb55d41b15d6dac618e83d0d518b2daf37a432.exe
Size

8.2MB
Sample

241202-2m13bawqew
MD5

a9c120726ef9a1ed337d7e3280bd73aa
SHA1

a4003fa42b1ba5cec9fa3d5fe58f40b8328b3a90
SHA256

2eeb366090643a685dc88b0578cb55d41b15d6dac618e83d0d518b2daf37a432
SHA512

ee207088c47b847139f3f66a8f7a7b1ec04e8779cd34e3ccf3cf70491b5fdb9205d0f4fa14298f46dfa7fa8ce4c79e313b9ff517f06c4c8263ee50ac65ba95f0
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecz:V8e8e8f8e8e8y

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  2eeb366090643a685dc88b0578cb55d41b15d6dac618e83d0d518b2daf37a432.exe
- Size
  
  8.2MB
- MD5
  
  a9c120726ef9a1ed337d7e3280bd73aa
- SHA1
  
  a4003fa42b1ba5cec9fa3d5fe58f40b8328b3a90
- SHA256
  
  2eeb366090643a685dc88b0578cb55d41b15d6dac618e83d0d518b2daf37a432
- SHA512
  
  ee207088c47b847139f3f66a8f7a7b1ec04e8779cd34e3ccf3cf70491b5fdb9205d0f4fa14298f46dfa7fa8ce4c79e313b9ff517f06c4c8263ee50ac65ba95f0
- SSDEEP
  
  49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecz:V8e8e8f8e8e8y
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence