warzonerat | 2b53866609ceec5e07cf009af7b80c05cb93160470e88d75a58a982a30a33ec1 | Triage

Sharing

General

Target

2b53866609ceec5e07cf009af7b80c05cb93160470e88d75a58a982a30a33ec1.exe
Size

1.8MB
Sample

241226-ktjm6s1nbt
MD5

1a4c4fbf0d81bd7974c97e8a466a5620
SHA1

b3d3834bc3ef3cc5b798b05a814e81c26975459d
SHA256

2b53866609ceec5e07cf009af7b80c05cb93160470e88d75a58a982a30a33ec1
SHA512

7d3b7f55e5582e98de6dfa3f5f620f14e9ab0fdfaa0ea737497189991d5fc683761df6d1ec745aec840f880fe17a4f776a07a3964b8c51c4c0827e851eee4e39
SSDEEP

12288:Q99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSG9dA7W2FeDSIGVH/KIDgI:k1gg4CppEI6GGfWDkMQDbGV6eH8tkN

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  2b53866609ceec5e07cf009af7b80c05cb93160470e88d75a58a982a30a33ec1.exe
- Size
  
  1.8MB
- MD5
  
  1a4c4fbf0d81bd7974c97e8a466a5620
- SHA1
  
  b3d3834bc3ef3cc5b798b05a814e81c26975459d
- SHA256
  
  2b53866609ceec5e07cf009af7b80c05cb93160470e88d75a58a982a30a33ec1
- SHA512
  
  7d3b7f55e5582e98de6dfa3f5f620f14e9ab0fdfaa0ea737497189991d5fc683761df6d1ec745aec840f880fe17a4f776a07a3964b8c51c4c0827e851eee4e39
- SSDEEP
  
  12288:Q99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSG9dA7W2FeDSIGVH/KIDgI:k1gg4CppEI6GGfWDkMQDbGV6eH8tkN
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence