warzonerat | 377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596 | Triage

Sharing

General

Target

377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596.exe
Size

8.2MB
Sample

241222-dgqgma1kaw
MD5

ad3dd9c2c6423605528cc7d5bb3446f0
SHA1

0ff822e6a9af16f2f61cc24bb53b9a51808f68ca
SHA256

377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596
SHA512

12fd4cbc0285310ad0aacbf662dea489ef8a867011beed5171a16a66dbe3633f0af625e990802d7230c75985d0f70d2423e11b956d3d519a549c36331dd630cf
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNect:V8e8e8f8e8e8O

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596.exe
- Size
  
  8.2MB
- MD5
  
  ad3dd9c2c6423605528cc7d5bb3446f0
- SHA1
  
  0ff822e6a9af16f2f61cc24bb53b9a51808f68ca
- SHA256
  
  377ee7bad1a3a62f5063de3d8fe7f9664b157b2599f3e1ce868010095b6da596
- SHA512
  
  12fd4cbc0285310ad0aacbf662dea489ef8a867011beed5171a16a66dbe3633f0af625e990802d7230c75985d0f70d2423e11b956d3d519a549c36331dd630cf
- SSDEEP
  
  49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNect:V8e8e8f8e8e8O
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence