warzonerat | f866c1b0a512d179e9e5274747c91c4736291d10540ff293da4a49dfa9e864bc | Triage

Sharing

General

Target

f866c1b0a512d179e9e5274747c91c4736291d10540ff293da4a49dfa9e864bc.exe
Size

8.2MB
Sample

241203-wcdw5swlht
MD5

d26305a9ad4022500d6f61c75e9ff117
SHA1

efcf05ee6dfe8fe55efce4567e5d5c81924d77a4
SHA256

f866c1b0a512d179e9e5274747c91c4736291d10540ff293da4a49dfa9e864bc
SHA512

50a2dc94de010506c7c1793452296c71139ffacd0144d5f4056d2ae329ccbadb8c65dc7640be0ad2c10bc4358499a3ac5b27344051693bd009bf212c4460f202
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecM:V8e8e8f8e8e8N

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  f866c1b0a512d179e9e5274747c91c4736291d10540ff293da4a49dfa9e864bc.exe
- Size
  
  8.2MB
- MD5
  
  d26305a9ad4022500d6f61c75e9ff117
- SHA1
  
  efcf05ee6dfe8fe55efce4567e5d5c81924d77a4
- SHA256
  
  f866c1b0a512d179e9e5274747c91c4736291d10540ff293da4a49dfa9e864bc
- SHA512
  
  50a2dc94de010506c7c1793452296c71139ffacd0144d5f4056d2ae329ccbadb8c65dc7640be0ad2c10bc4358499a3ac5b27344051693bd009bf212c4460f202
- SSDEEP
  
  49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecM:V8e8e8f8e8e8N
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence