warzonerat | 367bc647ef9d9142fe5fea7739db236563dadb6f83e69fec1bfa805edb1931fe | Triage

Sharing

General

Target

367bc647ef9d9142fe5fea7739db236563dadb6f83e69fec1bfa805edb1931fe.exe
Size

1.8MB
Sample

241226-deex4svqfn
MD5

da3d768b0db3b9570fbdc7b42b2bc9c9
SHA1

d9b931877f822c3c7d17510ab86e737cfecd3a3a
SHA256

367bc647ef9d9142fe5fea7739db236563dadb6f83e69fec1bfa805edb1931fe
SHA512

5c43584aece41a45831d8389f05d95ec9462a0fd1049d69ca94ed02c05060331c5037a1fae72d9941b6e1b38d09a1960dd0bceeb560d99e55e4ea239bda77de4
SSDEEP

12288:i254f/VAuj79umm3xR0lq+X6kOyeXiYxewRJBWW59qA7W2FeDSIGVH/KIDgDgUeL:x+D9uVMpjOyerrFQDbGV6eH81k/

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  367bc647ef9d9142fe5fea7739db236563dadb6f83e69fec1bfa805edb1931fe.exe
- Size
  
  1.8MB
- MD5
  
  da3d768b0db3b9570fbdc7b42b2bc9c9
- SHA1
  
  d9b931877f822c3c7d17510ab86e737cfecd3a3a
- SHA256
  
  367bc647ef9d9142fe5fea7739db236563dadb6f83e69fec1bfa805edb1931fe
- SHA512
  
  5c43584aece41a45831d8389f05d95ec9462a0fd1049d69ca94ed02c05060331c5037a1fae72d9941b6e1b38d09a1960dd0bceeb560d99e55e4ea239bda77de4
- SSDEEP
  
  12288:i254f/VAuj79umm3xR0lq+X6kOyeXiYxewRJBWW59qA7W2FeDSIGVH/KIDgDgUeL:x+D9uVMpjOyerrFQDbGV6eH81k/
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence