warzonerat | 8e2a4af633ffda92d8508e04274bad284ba57cddcdc2ee2c933a68ec6da5d4cd | Triage™

Analysis

max time kernel
131s
max time network
140s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
shipping documents.exe
Size 763KB
Sample201109-9masb2f5j2
SHA256 8e2a4af633ffda92d8508e04274bad284ba57cddcdc2ee2c933a68ec6da5d4cd
MD5 82d2906de93b7845589e9769f933da23
SHA1 5a6acfd63d2774a9ff93e35616bb9a41aba1b2b6
SHA512 ef5cbc6f28e7d7bf7d1de2ec96fdfc2425fb3ad114acc281c6ef0471b1a72ac7182acb28074d03a03aa42ba2e7188daf86932b3b3cc7034ef2d91cf5cb4acb84
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

resource	yara_rule
behavioral2/memory/656-0-0x0000000002C70000-0x0000000002DC3000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	shipping documents.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	shipping documents.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	shipping documents.exe
File opened for modification	C:\ProgramData:ApplicationData	shipping documents.exe

C:\Users\Admin\AppData\Local\Temp\shipping documents.exe
"C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"
1⤵
- Drops startup file
- NTFS ADS
PID:656

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/656-0-0x0000000002C70000-0x0000000002DC3000-memory.dmp

Download