warzonerat | 5c8ba98576d72f725ac03c6a79f3fbb39cd7ba65c54402e80af1d2d1f12c4d2a

Analysis

Target

New order_doc.exe
Size

959KB
MD5

4f725e7f05311c224ef49498892ba553
SHA1

49e95d8a392adff32361c96dce3db138ec7764f9
SHA256

76dd27ef96d337d45cfbc7585846d998f6b0f0a3c89255a9329862877432e098
SHA512

c7654e8392209773d534a20d73e0c148511ea164c82d1dc63e752bf4e02883a0b137d5d73e465a9164cfb4f13ee50579907cb45cbc6cb16c47dd2a390bd265df

Score

10^/10

Family

warzonerat

hongphilxxx.duckdns.org:65535

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/324-72-0x0000000000490000-0x00000000005E4000-memory.dmp	warzonerat

Suspicious use of WriteProcessMemory 16 IoCs

Processes:

New order_doc.exe

description	pid	process	target process
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe
PID 1816 wrote to memory of 324	1816	New order_doc.exe	logagent.exe

C:\Users\Admin\AppData\Local\Temp\New order_doc.exe
"C:\Users\Admin\AppData\Local\Temp\New order_doc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Windows\SysWOW64\logagent.exe
  C:\Windows\System32\logagent.exe
  2⤵
  PID:324

memory/324-66-0x0000000000000000-mapping.dmp

Download
memory/324-68-0x0000000000100000-0x0000000000101000-memory.dmp

Filesize
4KB

Download
memory/324-71-0x0000000010670000-0x00000000107C6000-memory.dmp

Filesize
1.3MB

Download
memory/324-70-0x00000000002E0000-0x00000000002E1000-memory.dmp

Filesize
4KB

Download
memory/324-72-0x0000000000490000-0x00000000005E4000-memory.dmp

Filesize
1.3MB

Download
memory/324-73-0x0000000000080000-0x0000000000081000-memory.dmp

Filesize
4KB

Download
memory/1816-60-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1816-61-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download
memory/1816-63-0x0000000000270000-0x000000000028A000-memory.dmp

Filesize
104KB

Download