warzonerat | 2254fd5aa66f24ce822bdf630ed2cbdc[.]exe

Resubmissions

19/08/2022, 15:57

220819-td6bnsfdfj10

12/07/2022, 08:24

220712-kapp3scff710

Sharing

Copy URL Twitter E-mail

General

Target
2254fd5aa66f24ce822bdf630ed2cbdc.exe
Size 146KB
Sample220712-kapp3scff7
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
SSDEEP 3072:zsAEZmjIxrUObrt/CRkQE2hB8qWjJ+oCz4bVVLTPmU9:z2YIhrrtqvoTCzgTLTPmU9
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

2254fd5aa66f24ce822bdf630ed2cbdc.exe

.exe 146KB

2254fd5aa66f24ce822bdf630ed2cbdc.exe

IMPHASH ef804870e7f7c9feae20101fdf049fe7
SHA256 bd6e789f312094e2d4a5caf66739fc0dda356a5c6c15603a6f73cab7a9f73366
MD5 2254fd5aa66f24ce822bdf630ed2cbdc
SHA1 7503d0420f9e89b48035b436ce427fad969801c8
SHA512 adbc99db31d713706548dedad7439fea85187feeff49a067eee26dd981703e90e79ad738fb7771f10d5af22d999345db4d6c3f19ca59c591dc9276595d92876e
SSDEEP 3072:zsAEZmjIxrUObrt/CRkQE2hB8qWjJ+oCz4bVVLTPmU9:z2YIhrrtqvoTCzgTLTPmU9
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat

PE Signature issue

Digest

35:e5:15:86:c2:a4:1c:44:ae:fe:d4:fd:41:f4:2f:62:8b:09:f0:fa

Digest Algorithm

sha1

PE Digests Matches

Not matched

Trusted

Subject

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

04:09:18:1b:5f:d5:bb:66:75:53:43:b5:6f:95:50:08

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Oct 22, 2013 - Oct 22, 2028

Subject

CN=Vitalwerks Internet Solutions\, Inc.,O=Vitalwerks Internet Solutions\, Inc.,L=Reno,ST=Nevada,C=US,1.2.840.113549.1.9.1=#0c0d445543404e6f2d49502e636f6d

Serial Number

0a:81:b0:78:d1:d4:55:4b:bf:cf:3d:01:62:a9:96:2b

Issuer

CN=DigiCert SHA2 Assured ID Code Signing CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Jan 19, 2016 - Mar 15, 2019

Subject

CN=DigiCert Timestamp Responder,O=DigiCert,C=US

Serial Number

03:01:9a:02:3a:ff:58:b1:6b:d6:d5:ea:e6:17:f0:66

Issuer

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Oct 22, 2014 - Oct 22, 2024

Subject

CN=DigiCert Assured ID CA-1,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

06:fd:f9:03:96:03:ad:ea:00:0a:eb:3f:27:bb:ba:1b

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageServerAuth, ExtKeyUsageClientAuth, ExtKeyUsageCodeSigning, ExtKeyUsageEmailProtection, ExtKeyUsageTimeStamping

Timespan

Nov 10, 2006 - Nov 10, 2021

Minor OS version

Major OS version

Entry point

27988

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

webservices

WsFileTimeToDateTime

bcrypt

BCryptSetProperty BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptDecrypt

kernel32

GetTickCount lstrcmpW HeapAlloc GetProcessHeap GetCommandLineA GetStartupInfoA HeapFree VirtualAlloc HeapReAlloc VirtualQuery LocalAlloc LocalFree SystemTimeToFileTime TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread GetModuleHandleW IsWow64Process WriteFile CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA GetFullPathNameA CreateFileA GlobalAlloc GetCurrentDirectoryW lstrcatA GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx WaitForSingleObject WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent CreateProcessW CreateEventA GetModuleFileNameW lstrcpyW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection lstrcmpA DeleteCriticalSection CreateMutexA ReleaseMutex TerminateProcess K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32NextW Process32FirstW DeleteFileW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW Process32First Process32Next GetTempPathA lstrlenA ExpandEnvironmentStringsW lstrlenW CreateProcessA WinExec ExitProcess GetProcAddress WideCharToMultiByte CloseHandle lstrcatW LoadLibraryA GetLastError GetPrivateProfileStringW GetModuleHandleA GetTempPathW VirtualFree SetLastError lstrcpyA GetModuleFileNameA CreateDirectoryW Sleep MultiByteToWideChar SetCurrentDirectoryW InitializeCriticalSection

user32

GetKeyState GetMessageA DispatchMessageA CreateWindowExW CallNextHookEx GetAsyncKeyState RegisterClassW GetRawInputData MapVirtualKeyA DefWindowProcA RegisterRawInputDevices TranslateMessage wsprintfA GetKeyNameTextW PostQuitMessage GetLastInputInfo GetForegroundWindow GetWindowTextW ToUnicode wsprintfW

advapi32

RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid LookupAccountSidW RegCreateKeyExW RegDeleteKeyW InitializeSecurityDescriptor RegDeleteKeyA SetSecurityDescriptorDacl RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW CloseServiceHandle GetTokenInformation RegSetValueExA

shell32

SHGetFolderPathW ShellExecuteExA ord680 SHGetKnownFolderPath SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW

urlmon

URLDownloadToFileW

ws2_32

getaddrinfo setsockopt freeaddrinfo htons recv socket send WSAConnect WSAStartup shutdown closesocket WSACleanup connect InetNtopW gethostbyname inet_addr

ole32

CoCreateInstance CoInitialize CoTaskMemFree CoUninitialize CoInitializeSecurity

shlwapi

StrStrW PathFindExtensionW PathCombineA PathFindFileNameW StrStrA PathRemoveFileSpecA PathFileExistsW

netapi32

NetUserAdd NetLocalGroupAddMembers

oleaut32

VariantInit

crypt32

CryptUnprotectData CryptStringToBinaryA CryptStringToBinaryW

wininet

InternetTimeToSystemTimeA