warzonerat | 17e9e943faa10a2886f8ab39ddf56c3f5f1f4f95b93788bfd9f6053425facb44 | Triage

Sharing

General

Target

17e9e943faa10a2886f8ab39ddf56c3f5f1f4f95b93788bfd9f6053425facb44.exe
Size

1.2MB
Sample

250101-rq1wlsxrcs
MD5

47e9cc731dd76e3a89de997a56614838
SHA1

73ffec20b6c69828cbcdaebea50a1f31bbe635c1
SHA256

17e9e943faa10a2886f8ab39ddf56c3f5f1f4f95b93788bfd9f6053425facb44
SHA512

eba14d8699594ac09cd086fa82c0f3c62fb137930984179df2b6a053357eca60f29f007b7cef8e6d65115fe3de31b9478feff4e03547a054753ae1fcd5ad4565
SSDEEP

12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11kr:OIbGD2JTu0GoZQDbGV6eH81kr

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  17e9e943faa10a2886f8ab39ddf56c3f5f1f4f95b93788bfd9f6053425facb44.exe
- Size
  
  1.2MB
- MD5
  
  47e9cc731dd76e3a89de997a56614838
- SHA1
  
  73ffec20b6c69828cbcdaebea50a1f31bbe635c1
- SHA256
  
  17e9e943faa10a2886f8ab39ddf56c3f5f1f4f95b93788bfd9f6053425facb44
- SHA512
  
  eba14d8699594ac09cd086fa82c0f3c62fb137930984179df2b6a053357eca60f29f007b7cef8e6d65115fe3de31b9478feff4e03547a054753ae1fcd5ad4565
- SSDEEP
  
  12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11kr:OIbGD2JTu0GoZQDbGV6eH81kr
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence