warzonerat | 87fe1cd3f02b4d9130d3b154497d00080dc9b279c0f31c2e6bd28427d9e515d4 | Triage

Sharing

General

Target

87fe1cd3f02b4d9130d3b154497d00080dc9b279c0f31c2e6bd28427d9e515d4.exe
Size

8.9MB
Sample

241222-sd558s1qe1
MD5

1a5487a6d3989827ee826c41cbf6cd53
SHA1

f7d69db2150b7fd3ecaa3f3925360e9da04a1daf
SHA256

87fe1cd3f02b4d9130d3b154497d00080dc9b279c0f31c2e6bd28427d9e515d4
SHA512

e1e590e627ab2a17a03f940c01240454a20078c43027efb19a50827e11fb10bb2098869fd078b0520c91ab5b824eb022deccb68b641f0a37729be74debc50f50
SSDEEP

49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecE:K1+8e8e8f8e8e81

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  87fe1cd3f02b4d9130d3b154497d00080dc9b279c0f31c2e6bd28427d9e515d4.exe
- Size
  
  8.9MB
- MD5
  
  1a5487a6d3989827ee826c41cbf6cd53
- SHA1
  
  f7d69db2150b7fd3ecaa3f3925360e9da04a1daf
- SHA256
  
  87fe1cd3f02b4d9130d3b154497d00080dc9b279c0f31c2e6bd28427d9e515d4
- SHA512
  
  e1e590e627ab2a17a03f940c01240454a20078c43027efb19a50827e11fb10bb2098869fd078b0520c91ab5b824eb022deccb68b641f0a37729be74debc50f50
- SSDEEP
  
  49152:K1XP6rPbNechC0bNechC0bNecIC0bNechC0bNechC0bNecE:K1+8e8e8f8e8e81
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence