warzonerat | 265abdebf294fad4ab13a9d38e00f28f44d6c7727aeccb1ff007086875134018 | Triage

Sharing

General

Target

265abdebf294fad4ab13a9d38e00f28f44d6c7727aeccb1ff007086875134018.exe
Size

8.2MB
Sample

241206-kq38eayrdy
MD5

e8ad50fec415dd28338d61c2a6a15dd4
SHA1

abadb6a8a4a30c0e6a983a1c93866c0f568b48ce
SHA256

265abdebf294fad4ab13a9d38e00f28f44d6c7727aeccb1ff007086875134018
SHA512

a14f2dc6b4443afc28c6b6dfc5819266b14d5bd002fdf395798f947f3579a176f89cb2b0e36ec69a71f9d0987e106d505d99cb6dc8bc65efe02d022d09af40d8
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecS:V8e8e8f8e8e8H

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  265abdebf294fad4ab13a9d38e00f28f44d6c7727aeccb1ff007086875134018.exe
- Size
  
  8.2MB
- MD5
  
  e8ad50fec415dd28338d61c2a6a15dd4
- SHA1
  
  abadb6a8a4a30c0e6a983a1c93866c0f568b48ce
- SHA256
  
  265abdebf294fad4ab13a9d38e00f28f44d6c7727aeccb1ff007086875134018
- SHA512
  
  a14f2dc6b4443afc28c6b6dfc5819266b14d5bd002fdf395798f947f3579a176f89cb2b0e36ec69a71f9d0987e106d505d99cb6dc8bc65efe02d022d09af40d8
- SSDEEP
  
  49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecS:V8e8e8f8e8e8H
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence