warzonerat | cae3b302e9608344b27619da824f86861d614bbb9e5f468fc76becf8b7225e8b | Triage

Analysis

max time kernel
144s
max time network
151s
platform
windows7_x64
resource
win7-20220715-en
resource tags

arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system
submitted
04-08-2022 21:28

Sharing

Report Analysis Logs

General

Target

RFQ#0472022.exe
Size

2.1MB
MD5

55fa55a71b21142169f5923de304c1b7
SHA1

783f6ee4f6a1e83fc1d1d53550c043952debd671
SHA256

cc9dd64a01b43b62102c0e1b82a0614c33e1dd375463c721f304945cdfb76f21
SHA512

bed1fa7909b3b14ed1f2d1459caf07655de2097ba096997cfecdf9e3d1ddfab836f6db24d2893223f7a8b3a92b5bcd711f510d9209e78e9756fbfdeb24000023

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

196.196.210.3:62520

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2012-55-0x0000000000440000-0x000000000059A000-memory.dmp	warzonerat
behavioral1/memory/2012-61-0x00000000028F0000-0x00000000032F0000-memory.dmp	warzonerat

C:\Users\Admin\AppData\Local\Temp\RFQ#0472022.exe
"C:\Users\Admin\AppData\Local\Temp\RFQ#0472022.exe"
1⤵
PID:2012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2012-54-0x0000000075791000-0x0000000075793000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000440000-0x000000000059A000-memory.dmp

Filesize
1.4MB

Download
memory/2012-61-0x00000000028F0000-0x00000000032F0000-memory.dmp

Filesize
10.0MB

Download