warzonerat | 672ae14fc78158bc3a5b44c20488600a02e54a9d9231420a343885ab7e1c8f4f

General

Target

4SgcpBifNVPbGl6.exe
Size

966KB
MD5

fbe792df5474f73a0b287a21ae093337
SHA1

9b9f41e121439f09ceef0d6e8d640f63a2433606
SHA256

672ae14fc78158bc3a5b44c20488600a02e54a9d9231420a343885ab7e1c8f4f
SHA512

7bb9527211da305efaecd75f02dad41e6c8daffc4b94d09c6af85ab03bc0d4af76dc8ef7383637f534468d32ce06e17893757d7c1ffacbaf4b43787bc450703f

Score

10^/10

Family

warzonerat

C2

103.125.189.167:1998

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1296-128-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/1296-130-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

Processes:

4SgcpBifNVPbGl6.exe

description pid process target process

PID 2696 set thread context of 1296 2696 4SgcpBifNVPbGl6.exe 4SgcpBifNVPbGl6.exe
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3520 1296 WerFault.exe 4SgcpBifNVPbGl6.exe
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

4SgcpBifNVPbGl6.exe

pid process

2696 4SgcpBifNVPbGl6.exe
2696 4SgcpBifNVPbGl6.exe
2696 4SgcpBifNVPbGl6.exe
2696 4SgcpBifNVPbGl6.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

4SgcpBifNVPbGl6.exe

description pid process

Token: SeDebugPrivilege 2696 4SgcpBifNVPbGl6.exe

description	pid	process	target process
PID 2696 set thread context of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe

pid	pid_target	process	target process
3520	1296	WerFault.exe	4SgcpBifNVPbGl6.exe

description	pid	process
Token: SeDebugPrivilege	2696	4SgcpBifNVPbGl6.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

4SgcpBifNVPbGl6.exe

description	pid	process	target process
PID 2696 wrote to memory of 752	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 752	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 752	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe
PID 2696 wrote to memory of 1296	2696	4SgcpBifNVPbGl6.exe	4SgcpBifNVPbGl6.exe

C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe
"C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe"
2⤵
PID:752

C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe
"C:\Users\Admin\AppData\Local\Temp\4SgcpBifNVPbGl6.exe"
2⤵
PID:1296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1296 -s 544
3⤵
- Program crash
PID:3520

memory/1296-128-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/1296-130-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-118-0x00000000731B0000-0x000000007389E000-memory.dmp

Filesize
6.9MB

Download
memory/2696-119-0x0000000000C70000-0x0000000000D6A000-memory.dmp

Filesize
1000KB

Download
memory/2696-120-0x0000000005BC0000-0x00000000060BE000-memory.dmp

Filesize
5.0MB

Download
memory/2696-121-0x0000000005760000-0x00000000057F2000-memory.dmp

Filesize
584KB

Download
memory/2696-122-0x00000000056C0000-0x0000000005BBE000-memory.dmp

Filesize
5.0MB

Download
memory/2696-123-0x00000000056E0000-0x00000000056EA000-memory.dmp

Filesize
40KB

Download
memory/2696-124-0x00000000059A0000-0x00000000059B8000-memory.dmp

Filesize
96KB

Download
memory/2696-125-0x0000000007F20000-0x0000000007FBC000-memory.dmp

Filesize
624KB

Download
memory/2696-126-0x0000000008180000-0x000000000826C000-memory.dmp

Filesize
944KB

Download
memory/2696-127-0x0000000008370000-0x0000000008392000-memory.dmp

Filesize
136KB

Download