warzonerat | 2fc28199ff0cf4d472198c044af8b126567ee94c64ef896edc1930c759a1e337 | Triage

Sharing

General

Target

2fc28199ff0cf4d472198c044af8b126567ee94c64ef896edc1930c759a1e337.exe
Size

1.2MB
Sample

241222-s6sevasmh1
MD5

3ffc22f1094d879a5f68b59a702ce013
SHA1

1068dc62b79792c70e225222631a026f217be846
SHA256

2fc28199ff0cf4d472198c044af8b126567ee94c64ef896edc1930c759a1e337
SHA512

db2292a7553451018b952bfe0bccd575c7cd5fda974acea2b60ad530c0f51180dc37a93f3e45dd2b6b68536af24308be4c47bd72d1259104d6a66c4cae2a898d
SSDEEP

12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ka:OIbGD2JTu0GoZQDbGV6eH81ka

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  2fc28199ff0cf4d472198c044af8b126567ee94c64ef896edc1930c759a1e337.exe
- Size
  
  1.2MB
- MD5
  
  3ffc22f1094d879a5f68b59a702ce013
- SHA1
  
  1068dc62b79792c70e225222631a026f217be846
- SHA256
  
  2fc28199ff0cf4d472198c044af8b126567ee94c64ef896edc1930c759a1e337
- SHA512
  
  db2292a7553451018b952bfe0bccd575c7cd5fda974acea2b60ad530c0f51180dc37a93f3e45dd2b6b68536af24308be4c47bd72d1259104d6a66c4cae2a898d
- SSDEEP
  
  12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11ka:OIbGD2JTu0GoZQDbGV6eH81ka
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence