warzonerat | ab61c833450dc9135eb1059dce99d1c53d6f8530f8e8ff66f8665da22f086ca7 | Triage

Sharing

General

Target

ab61c833450dc9135eb1059dce99d1c53d6f8530f8e8ff66f8665da22f086ca7.exe
Size

1.8MB
Sample

250120-c1drhaxjd1
MD5

859d55085f8120bd07af261dfc05ad59
SHA1

096edfd4d2b5f51cb303e24d16bfc30a31dd109b
SHA256

ab61c833450dc9135eb1059dce99d1c53d6f8530f8e8ff66f8665da22f086ca7
SHA512

f27770f995e863baed4faa5e703f4cc7c5c880d1817c2be15e749e57541fc6e0b868b4870e1c52a730a9c826952e0083bafed16bd00f4ec4dc66a3a43498f8cb
SSDEEP

12288:BUrjP8Xuc2UY0B8TIwDDMistJ6gicRzubSFJeOgTpBA7W2FeDSIGVH/KIDgDgUe+:ujjSYIUDJ86giGTPQDbGV6eH81ky

Score

10^/10

warzonerat discovery persistence rat

Malware Config

Targets

- Target
  
  ab61c833450dc9135eb1059dce99d1c53d6f8530f8e8ff66f8665da22f086ca7.exe
- Size
  
  1.8MB
- MD5
  
  859d55085f8120bd07af261dfc05ad59
- SHA1
  
  096edfd4d2b5f51cb303e24d16bfc30a31dd109b
- SHA256
  
  ab61c833450dc9135eb1059dce99d1c53d6f8530f8e8ff66f8665da22f086ca7
- SHA512
  
  f27770f995e863baed4faa5e703f4cc7c5c880d1817c2be15e749e57541fc6e0b868b4870e1c52a730a9c826952e0083bafed16bd00f4ec4dc66a3a43498f8cb
- SSDEEP
  
  12288:BUrjP8Xuc2UY0B8TIwDDMistJ6gicRzubSFJeOgTpBA7W2FeDSIGVH/KIDgDgUe+:ujjSYIUDJ86giGTPQDbGV6eH81ky
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoverypersistence

behavioral2

discoverypersistence