warzonerat | a6c22328747eaee0b88ce02ad48e8d2860cb275bc2494248a173ccc8bf891563

Analysis

Target
factura_00018963.exe
Size 764KB
Sample201109-3b5myscl62
SHA256 a6c22328747eaee0b88ce02ad48e8d2860cb275bc2494248a173ccc8bf891563
MD5 836abf7ec5a22faf77f886e437149a91
SHA1 644c764a33ff7d2d888b45dd883381dbc89e422f
SHA512 33285b398c965840057d79dfa3e11e90d9df21748ea71a566f263ec9cfae1b26bf9bb7b361236be0aeac425b5dec03f079e45fcb911de1aac4261ccdd552b01c
MD5 SHA1 SHA512

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

ServiceHost packer 1 IoCs

Detects ServiceHost packer used for .NET malware

resource	yara_rule
behavioral2/memory/2844-3-0x0000000000000000-mapping.dmp	servicehost

Warzone RAT Payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/912-0-0x0000000002CB0000-0x0000000002E03000-memory.dmp	warzonerat

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 2844	912	factura_00018963.exe	79
PID 912 wrote to memory of 2844	912	factura_00018963.exe	79
PID 912 wrote to memory of 2844	912	factura_00018963.exe	79
PID 912 wrote to memory of 2844	912	factura_00018963.exe	79
PID 912 wrote to memory of 2844	912	factura_00018963.exe	79

C:\Users\Admin\AppData\Local\Temp\factura_00018963.exe
"C:\Users\Admin\AppData\Local\Temp\factura_00018963.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:912
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:2844

memory/912-0-0x0000000002CB0000-0x0000000002E03000-memory.dmp

Download

memory/2844-2-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

Download