warzonerat | a285bb5e44acd983dc61a670da2bf632b5263e481f372fde413cd0f5091c5ced | Triage

Sharing

General

Target

a285bb5e44acd983dc61a670da2bf632b5263e481f372fde413cd0f5091c5ced.exe
Size

1.8MB
Sample

241226-qqhjlawrfk
MD5

bfc0f5ab6d6546668b4b2660ee73ad9e
SHA1

4ff7621a25fc899b4bfe2f33e4daaa8445af1d74
SHA256

a285bb5e44acd983dc61a670da2bf632b5263e481f372fde413cd0f5091c5ced
SHA512

b287c153d5e89f07ce4c15b039f3730361a190e2af1c7957afec382b42586f8d161fcc67f0a89daa950788a1fa73244da8d9b378964657fd95e08e33037b74d8
SSDEEP

12288:i254f/VAuj79umm3xR0lq+X6kOyeXiYxewRJBWW59qA7W2FeDSIGVH/KIDgDgUe8:x+D9uVMpjOyerrFQDbGV6eH81kA

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  a285bb5e44acd983dc61a670da2bf632b5263e481f372fde413cd0f5091c5ced.exe
- Size
  
  1.8MB
- MD5
  
  bfc0f5ab6d6546668b4b2660ee73ad9e
- SHA1
  
  4ff7621a25fc899b4bfe2f33e4daaa8445af1d74
- SHA256
  
  a285bb5e44acd983dc61a670da2bf632b5263e481f372fde413cd0f5091c5ced
- SHA512
  
  b287c153d5e89f07ce4c15b039f3730361a190e2af1c7957afec382b42586f8d161fcc67f0a89daa950788a1fa73244da8d9b378964657fd95e08e33037b74d8
- SSDEEP
  
  12288:i254f/VAuj79umm3xR0lq+X6kOyeXiYxewRJBWW59qA7W2FeDSIGVH/KIDgDgUe8:x+D9uVMpjOyerrFQDbGV6eH81kA
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence