warzonerat | 5d888bc6d0a7f5da0c94a55113d93a3f8b894472c4d42af88c7cf7cb885d95ad | Triage

Analysis

max time kernel
58s
max time network
168s
platform
windows7_x64
resource
win7v20210410
submitted
26-07-2021 14:01

Sharing

Report Analysis Logs

General

Target

1970-11-30__633003.pdf.exe
Size

664KB
MD5

12ef0fd781cfabe54c57fb2f5176ec19
SHA1

8a5b06b14840ca31017b6ec46319cd7a787ed975
SHA256

5d888bc6d0a7f5da0c94a55113d93a3f8b894472c4d42af88c7cf7cb885d95ad
SHA512

8c68b10a83c65cae967f3ebe15a6011f6448e772d24fb0f85df70d889bdccdd85f951444cf682483be94ec30b646931f9115e81e3663a1c2e3f00b4bd98b1d53

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

blacice24.hopto.org:5032

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1644-62-0x00000000047E0000-0x0000000004934000-memory.dmp	warzonerat

C:\Users\Admin\AppData\Local\Temp\1970-11-30__633003.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\1970-11-30__633003.pdf.exe"
1⤵
PID:1644

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1644-59-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/1644-60-0x00000000766D1000-0x00000000766D3000-memory.dmp

Filesize
8KB

Download
memory/1644-61-0x0000000004681000-0x00000000047D5000-memory.dmp

Filesize
1.3MB

Download
memory/1644-62-0x00000000047E0000-0x0000000004934000-memory.dmp

Filesize
1.3MB

Download