warzonerat | 94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed

Analysis

Target

94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe
Size

113KB
MD5

d972674471d1f347c6a04b5b56531a2a
SHA1

9d5f3b87dd68ba5afba63e45ec404c14c4fde08c
SHA256

94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed
SHA512

38db71960df971a3bc92ff5259a5d709f54dbeeacf47b5200ce9df29004fef01cd52026b56631864395a6810d442ad54bc73f5426560673a463609f0cd011fcb

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

powershell.exe

pid process

1744 powershell.exe
1744 powershell.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

powershell.exe

description pid process

Token: SeDebugPrivilege 1744 powershell.exe

pid	process
1744	powershell.exe
1744	powershell.exe

description	pid	process
Token: SeDebugPrivilege	1744	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe

description	pid	process	target process
PID 980 wrote to memory of 1744	980	94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe	powershell.exe
PID 980 wrote to memory of 1744	980	94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe	powershell.exe
PID 980 wrote to memory of 1744	980	94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe	powershell.exe
PID 980 wrote to memory of 1744	980	94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe	powershell.exe

C:\Users\Admin\AppData\Local\Temp\94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe
"C:\Users\Admin\AppData\Local\Temp\94e06e20f3c2a738c5f507b08011b5cf5123f57ab23140e9377cd597387bebed.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980

memory/980-60-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

Filesize
8KB

Download
memory/1744-61-0x0000000000000000-mapping.dmp

Download
memory/1744-63-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/1744-64-0x0000000004980000-0x0000000004981000-memory.dmp

Filesize
4KB

Download
memory/1744-65-0x0000000004940000-0x0000000004941000-memory.dmp

Filesize
4KB

Download
memory/1744-66-0x0000000004942000-0x0000000004943000-memory.dmp

Filesize
4KB

Download
memory/1744-67-0x00000000024C0000-0x00000000024C1000-memory.dmp

Filesize
4KB

Download
memory/1744-68-0x0000000002710000-0x0000000002711000-memory.dmp

Filesize
4KB

Download
memory/1744-71-0x00000000055F0000-0x00000000055F1000-memory.dmp

Filesize
4KB

Download
memory/1744-73-0x000000007EF30000-0x000000007EF31000-memory.dmp

Filesize
4KB

Download
memory/1744-77-0x00000000056A0000-0x00000000056A1000-memory.dmp

Filesize
4KB

Download
memory/1744-78-0x00000000061D0000-0x00000000061D1000-memory.dmp

Filesize
4KB

Download
memory/1744-85-0x0000000006280000-0x0000000006281000-memory.dmp

Filesize
4KB

Download
memory/1744-86-0x00000000055B0000-0x00000000055B1000-memory.dmp

Filesize
4KB

Download
memory/1744-100-0x0000000006300000-0x0000000006301000-memory.dmp

Filesize
4KB

Download
memory/1744-101-0x0000000006310000-0x0000000006311000-memory.dmp

Filesize
4KB

Download