warzonerat | 72b22fc9be1cc59b6b8677642a4803eeeadebe06987b78db80e5149de5f7f44b

Analysis

Target
F0003-960063.exe
Size 1.2MB
Sample220613-l43pgabfd6
SHA256 72b22fc9be1cc59b6b8677642a4803eeeadebe06987b78db80e5149de5f7f44b
MD5 6fe5939a4a600e12921d7b22b381f7b3
SHA1 3de1d7d51d99e04e0e45a963ebff0a83a0581573
SHA512 7c04801c078c61c03b1fd19fbcb1d71009aa7ff22d00fabf4c2591106fa387898517183b51213e0794f6c33ce2a9d05cf421fa4d845947082b2135939d83f7b6
MD5 SHA1 SHA512

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 2 IoCs

rat

resource	yara_rule
behavioral1/memory/1664-55-0x0000000001EF0000-0x00000000028F0000-memory.dmp	warzonerat
behavioral1/memory/1664-56-0x0000000000750000-0x00000000008A9000-memory.dmp	warzonerat

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1692	1664	F0003-960063.exe	29
PID 1664 wrote to memory of 1692	1664	F0003-960063.exe	29
PID 1664 wrote to memory of 1692	1664	F0003-960063.exe	29
PID 1664 wrote to memory of 1692	1664	F0003-960063.exe	29
PID 1664 wrote to memory of 1692	1664	F0003-960063.exe	29
PID 1664 wrote to memory of 1692	1664	F0003-960063.exe	29

C:\Users\Admin\AppData\Local\Temp\F0003-960063.exe
"C:\Users\Admin\AppData\Local\Temp\F0003-960063.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:1692

memory/1664-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Download

memory/1664-55-0x0000000001EF0000-0x00000000028F0000-memory.dmp

Download

memory/1664-56-0x0000000000750000-0x00000000008A9000-memory.dmp

Download

memory/1692-63-0x00000000002E0000-0x00000000002E1000-memory.dmp

Download