warzonerat | 76dd27ef96d337d45cfbc7585846d998f6b0f0a3c89255a9329862877432e098

Analysis

Target

New order_doc.exe
Size

959KB
MD5

4f725e7f05311c224ef49498892ba553
SHA1

49e95d8a392adff32361c96dce3db138ec7764f9
SHA256

76dd27ef96d337d45cfbc7585846d998f6b0f0a3c89255a9329862877432e098
SHA512

c7654e8392209773d534a20d73e0c148511ea164c82d1dc63e752bf4e02883a0b137d5d73e465a9164cfb4f13ee50579907cb45cbc6cb16c47dd2a390bd265df

Score

10^/10

Family

warzonerat

hongphilxxx.duckdns.org:65535

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1152-73-0x0000000000920000-0x0000000000A74000-memory.dmp	warzonerat

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

New order_doc.exe

description	pid	process	target process
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe
PID 540 wrote to memory of 1152	540	New order_doc.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\New order_doc.exe
"C:\Users\Admin\AppData\Local\Temp\New order_doc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\internet explorer\ieinstal.exe
  "C:\Program Files (x86)\internet explorer\ieinstal.exe"
  2⤵
  PID:1152

memory/540-60-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/540-61-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/540-63-0x0000000000610000-0x000000000062A000-memory.dmp

Filesize
104KB

Download
memory/1152-66-0x0000000000000000-mapping.dmp

Download
memory/1152-69-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1152-68-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1152-71-0x0000000000140000-0x0000000000141000-memory.dmp

Filesize
4KB

Download
memory/1152-72-0x0000000010670000-0x00000000107C6000-memory.dmp

Filesize
1.3MB

Download
memory/1152-73-0x0000000000920000-0x0000000000A74000-memory.dmp

Filesize
1.3MB

Download