warzonerat | a4ab8a7b0a10f71db88113f5c36b3cae8079cee617de4c0c4b1a5251728a7e92 | Triage

Sharing

General

Target

a4ab8a7b0a10f71db88113f5c36b3cae8079cee617de4c0c4b1a5251728a7e92.exe
Size

1.2MB
Sample

250107-m77y2azqer
MD5

d6cf422a05018007070eccd8fd94ec2d
SHA1

97ee8722f59b4acc650f44d568b0af21101878ff
SHA256

a4ab8a7b0a10f71db88113f5c36b3cae8079cee617de4c0c4b1a5251728a7e92
SHA512

d91aa15fea15f688428354842dc6c154807b85efb44daee0d0f4f829d44365c9482256e25b36c53e78de243b0f1b0bce3855a039dc105bbe6b5d70f44a04fb8f
SSDEEP

12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11kM:OIbGD2JTu0GoZQDbGV6eH81kM

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  a4ab8a7b0a10f71db88113f5c36b3cae8079cee617de4c0c4b1a5251728a7e92.exe
- Size
  
  1.2MB
- MD5
  
  d6cf422a05018007070eccd8fd94ec2d
- SHA1
  
  97ee8722f59b4acc650f44d568b0af21101878ff
- SHA256
  
  a4ab8a7b0a10f71db88113f5c36b3cae8079cee617de4c0c4b1a5251728a7e92
- SHA512
  
  d91aa15fea15f688428354842dc6c154807b85efb44daee0d0f4f829d44365c9482256e25b36c53e78de243b0f1b0bce3855a039dc105bbe6b5d70f44a04fb8f
- SSDEEP
  
  12288:OIbsBDU0I6+Tu0TJ0N1oYgNOFDA7W2FeDSIGVH/KIDgDgUeHbY11kM:OIbGD2JTu0GoZQDbGV6eH81kM
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence