warzonerat | 6cd9680a21d7f13a34e111c1f9e645b1b657b8b7e13ce16deddfee2b003f7579

Analysis

max time kernel
43s
max time network
152s
platform
windows7_x64
resource
win7v20210410
submitted
22-07-2021 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Urgent_request_for_quotation.exe
Size

736KB
MD5

392c8ecd4e0adeffe68d8365a4834bc1
SHA1

7e84b2d4cb21efa0324c956ff7f7d5c12fbb586f
SHA256

6cd9680a21d7f13a34e111c1f9e645b1b657b8b7e13ce16deddfee2b003f7579
SHA512

891dd53d7f3ffd1811fbf5b7bb2e3a645c9fe7294957bb0c46e0f45ece8566226904c69e20d3174ce5de33b5932b9c7d5ae18f333d78f0f9ef862d27a253f2f9

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

79.134.225.8:8654

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Urgent_request_for_quotation.exe

description	pid	process	target process
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe
PID 1856 wrote to memory of 1892	1856	Urgent_request_for_quotation.exe	ieinstal.exe

C:\Users\Admin\AppData\Local\Temp\Urgent_request_for_quotation.exe
"C:\Users\Admin\AppData\Local\Temp\Urgent_request_for_quotation.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1856

C:\Program Files (x86)\internet explorer\ieinstal.exe
"C:\Program Files (x86)\internet explorer\ieinstal.exe"
2⤵
PID:1892

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1856-60-0x00000000752B1000-0x00000000752B3000-memory.dmp

Filesize
8KB

Download
memory/1856-61-0x0000000000330000-0x0000000000331000-memory.dmp

Filesize
4KB

Download
memory/1892-62-0x0000000000000000-mapping.dmp

Download
memory/1892-65-0x0000000000180000-0x0000000000181000-memory.dmp

Filesize
4KB

Download
memory/1892-64-0x00000000000D0000-0x00000000000D1000-memory.dmp

Filesize
4KB

Download
memory/1892-67-0x0000000000AB0000-0x0000000000C0E000-memory.dmp

Filesize
1.4MB

Download
memory/1892-66-0x0000000010670000-0x00000000107D0000-memory.dmp

Filesize
1.4MB

Download
memory/1892-68-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download