warzonerat | 93f444ab72f6280c3e031e9b8d2e1732f714edfc0ffb9177f9284654566d685c | Triage

Sharing

General

Target

93f444ab72f6280c3e031e9b8d2e1732f714edfc0ffb9177f9284654566d685c.exe
Size

8.2MB
Sample

250324-dz2ydayp15
MD5

dcb4f4c7c97fb8cac7eb2b2f307c9112
SHA1

4ba4b20ad8772e70de22a14926202b2a149707e2
SHA256

93f444ab72f6280c3e031e9b8d2e1732f714edfc0ffb9177f9284654566d685c
SHA512

6ce3f11dc9fcc08b6be7872cf18122c065ca08ace88729aec661197b4de0ec65ff0d0480707e69931f00c518fd2299ab395bedd64b7caef9fc866bd937c8ae9b
SSDEEP

49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecd:V8e8e8f8e8e8M

Score

10^/10

warzonerat aspackv2 discovery persistence rat

Malware Config

Targets

- Target
  
  93f444ab72f6280c3e031e9b8d2e1732f714edfc0ffb9177f9284654566d685c.exe
- Size
  
  8.2MB
- MD5
  
  dcb4f4c7c97fb8cac7eb2b2f307c9112
- SHA1
  
  4ba4b20ad8772e70de22a14926202b2a149707e2
- SHA256
  
  93f444ab72f6280c3e031e9b8d2e1732f714edfc0ffb9177f9284654566d685c
- SHA512
  
  6ce3f11dc9fcc08b6be7872cf18122c065ca08ace88729aec661197b4de0ec65ff0d0480707e69931f00c518fd2299ab395bedd64b7caef9fc866bd937c8ae9b
- SSDEEP
  
  49152:7C0bNechC0bNechC0bNecIC0bNechC0bNechC0bNecd:V8e8e8f8e8e8M
Score

6^/10

discovery persistence
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

rataspackv2warzonerat

behavioral1

discoverypersistence

behavioral2

discoverypersistence