warzonerat | 131061ee1a0f0a0fe21148c747d349b33cc246f4d085d057662085e04ee8bbd1 | Triage

Sharing

General

Target

131061ee1a0f0a0fe21148c747d349b33cc246f4d085d057662085e04ee8bbd1.exe
Size

1.8MB
Sample

250116-xhj6satnhs
MD5

05305cb30d51eda96295dfb0d396c1a9
SHA1

2975256bcb05763c88668ba0e6459c5047681674
SHA256

131061ee1a0f0a0fe21148c747d349b33cc246f4d085d057662085e04ee8bbd1
SHA512

d27ecb671813e9c01fc92ee20726f9e32990759d59b13c5666effecf5f4ffeaf230115e7253f0a751f781eaa37306afb70c67aeb4c66cc3ad8ddc9962131dd54
SSDEEP

12288:p99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgl:r1gg4CppEI6GGfWDkCQDbGV6eH81kK

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  131061ee1a0f0a0fe21148c747d349b33cc246f4d085d057662085e04ee8bbd1.exe
- Size
  
  1.8MB
- MD5
  
  05305cb30d51eda96295dfb0d396c1a9
- SHA1
  
  2975256bcb05763c88668ba0e6459c5047681674
- SHA256
  
  131061ee1a0f0a0fe21148c747d349b33cc246f4d085d057662085e04ee8bbd1
- SHA512
  
  d27ecb671813e9c01fc92ee20726f9e32990759d59b13c5666effecf5f4ffeaf230115e7253f0a751f781eaa37306afb70c67aeb4c66cc3ad8ddc9962131dd54
- SSDEEP
  
  12288:p99Vbpgx4OuE+aCpBPY0PkI686WNUfWO6yuXzT5SPlSGN/A7W2FeDSIGVH/KIDgl:r1gg4CppEI6GGfWDkCQDbGV6eH81kK
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence