warzonerat | f91fb2a8622feb3a38ba7ff4b1f6b27f41404c3a34cddefce9b1ee2c43cb58dd | Triage

Sharing

General

Target

f91fb2a8622feb3a38ba7ff4b1f6b27f41404c3a34cddefce9b1ee2c43cb58dd.exe
Size

8.9MB
Sample

241219-lgc6asymgs
MD5

b99884e75562a7dc6cf051f66534cdd9
SHA1

2ebf2196603c7a2fda5a14f28df3eaa3faf09538
SHA256

f91fb2a8622feb3a38ba7ff4b1f6b27f41404c3a34cddefce9b1ee2c43cb58dd
SHA512

6c60f6eb71de14dcd8ea1b47c7b100e59d5fd52ff0ba27c6dadee258d6a42d20485245fcea5496519d9ea2f258ccee3b79a95c08bbbff2db76f7976066839de9
SSDEEP

49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecO:K1+8e8e8f8e8e8F

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  f91fb2a8622feb3a38ba7ff4b1f6b27f41404c3a34cddefce9b1ee2c43cb58dd.exe
- Size
  
  8.9MB
- MD5
  
  b99884e75562a7dc6cf051f66534cdd9
- SHA1
  
  2ebf2196603c7a2fda5a14f28df3eaa3faf09538
- SHA256
  
  f91fb2a8622feb3a38ba7ff4b1f6b27f41404c3a34cddefce9b1ee2c43cb58dd
- SHA512
  
  6c60f6eb71de14dcd8ea1b47c7b100e59d5fd52ff0ba27c6dadee258d6a42d20485245fcea5496519d9ea2f258ccee3b79a95c08bbbff2db76f7976066839de9
- SSDEEP
  
  49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecO:K1+8e8e8f8e8e8F
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence