warzonerat | 72b22fc9be1cc59b6b8677642a4803eeeadebe06987b78db80e5149de5f7f44b

Analysis

Target
F0003-960063.exe
Size 1.2MB
Sample220613-l43pgabfd6
SHA256 72b22fc9be1cc59b6b8677642a4803eeeadebe06987b78db80e5149de5f7f44b
MD5 6fe5939a4a600e12921d7b22b381f7b3
SHA1 3de1d7d51d99e04e0e45a963ebff0a83a0581573
SHA512 7c04801c078c61c03b1fd19fbcb1d71009aa7ff22d00fabf4c2591106fa387898517183b51213e0794f6c33ce2a9d05cf421fa4d845947082b2135939d83f7b6
MD5 SHA1 SHA512

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT Payload 2 IoCs

rat

resource	yara_rule
behavioral2/memory/2992-130-0x00000000029E0000-0x00000000033E0000-memory.dmp	warzonerat
behavioral2/memory/2992-131-0x0000000002820000-0x0000000002979000-memory.dmp	warzonerat

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4380	2992	F0003-960063.exe	84
PID 2992 wrote to memory of 4380	2992	F0003-960063.exe	84
PID 2992 wrote to memory of 4380	2992	F0003-960063.exe	84
PID 2992 wrote to memory of 4380	2992	F0003-960063.exe	84
PID 2992 wrote to memory of 4380	2992	F0003-960063.exe	84

C:\Users\Admin\AppData\Local\Temp\F0003-960063.exe
"C:\Users\Admin\AppData\Local\Temp\F0003-960063.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe"
  2⤵
  PID:4380

memory/2992-130-0x00000000029E0000-0x00000000033E0000-memory.dmp

Download

memory/2992-131-0x0000000002820000-0x0000000002979000-memory.dmp

Download

memory/4380-138-0x0000000001440000-0x0000000001441000-memory.dmp

Download