warzonerat | b5b64f85cdeb5432018e22087fce4b6dc1e56593e8416335f471d4eac1e2b8cf | Triage™

Analysis

max time kernel
144s
max time network
148s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PI#222145.exe
Size 1.0MB
Sample201109-szfcnaexnn
SHA256 b5b64f85cdeb5432018e22087fce4b6dc1e56593e8416335f471d4eac1e2b8cf
MD5 2a02001df87e30cca1c88125646dbe4e
SHA1 fc74a24986ab1480b8b2e6328c56a6444bde86da
SHA512 2cb4ded84d96655f8946c5baf8e2931d84cdf605dfada75336034e0d26da7ad6d3eced16b8e6a245ded445c4066e1643fa4a842e8ef20e3efec90703826f00ba
MD5 SHA1 SHA512

Score

10^/10

warzonerat infostealer rat

Malware Config

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

resource	yara_rule
behavioral2/memory/980-0-0x0000000001130000-0x0000000001283000-memory.dmp	warzonerat

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat	PI#222145.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start	PI#222145.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\ProgramData:ApplicationData	PI#222145.exe
File opened for modification	C:\ProgramData:ApplicationData	PI#222145.exe

C:\Users\Admin\AppData\Local\Temp\PI#222145.exe
"C:\Users\Admin\AppData\Local\Temp\PI#222145.exe"
1⤵
- Drops startup file
- NTFS ADS
PID:980

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/980-0-0x0000000001130000-0x0000000001283000-memory.dmp

Download