warzonerat | 013bdafd5d661ce28a1f4930ec096a51c8f730847538b3ed9ed90d0922ba9a09 | Triage

Sharing

General

Target

013bdafd5d661ce28a1f4930ec096a51c8f730847538b3ed9ed90d0922ba9a09.exe
Size

1.8MB
Sample

241226-ke5xvs1naq
MD5

874ca70b44fb0d3ac94c0de58127e83c
SHA1

eb817579fdde3c511c1d8ba47bd553a5f701fe5b
SHA256

013bdafd5d661ce28a1f4930ec096a51c8f730847538b3ed9ed90d0922ba9a09
SHA512

07d6753a40bc04c38b0e491562e19abf1d4b9db6566b413d5a1ef1c325b4da3a45846da5fc5bc1592db5f6a6bc2e726c3665d4ac88ec9da6ed33400922abb571
SSDEEP

12288:BUrjP8Xuc2UY0B8TIwDDMistJ6gicRzubSFJeOgTpBA7W2FeDSIGVH/KIDgDgUee:ujjSYIUDJ86giGTPQDbGV6eH81ka

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  013bdafd5d661ce28a1f4930ec096a51c8f730847538b3ed9ed90d0922ba9a09.exe
- Size
  
  1.8MB
- MD5
  
  874ca70b44fb0d3ac94c0de58127e83c
- SHA1
  
  eb817579fdde3c511c1d8ba47bd553a5f701fe5b
- SHA256
  
  013bdafd5d661ce28a1f4930ec096a51c8f730847538b3ed9ed90d0922ba9a09
- SHA512
  
  07d6753a40bc04c38b0e491562e19abf1d4b9db6566b413d5a1ef1c325b4da3a45846da5fc5bc1592db5f6a6bc2e726c3665d4ac88ec9da6ed33400922abb571
- SSDEEP
  
  12288:BUrjP8Xuc2UY0B8TIwDDMistJ6gicRzubSFJeOgTpBA7W2FeDSIGVH/KIDgDgUee:ujjSYIUDJ86giGTPQDbGV6eH81ka
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence