warzonerat | f1f4236ceb4c0b97583de4744e4f30b5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
f1f4236ceb4c0b97583de4744e4f30b5.exe
Size 152KB
Sample220911-jptrxabcc6
SHA256 0fb4fd33e3c5368794c0f8e8d5556ef25f1fc808e8db64c9b45e7949e6ee4736
MD5 f1f4236ceb4c0b97583de4744e4f30b5
SHA1 41e8585656af94ba33b1810eadecf30dc9a42fb4
SHA512 06ddd7b3c06fc7984195c27246759aa5a51a45447909f3ab67bee217491f0eb5e285227e22bd1111ccaa25c7c3c29e61fa484293e0651c77f0146566a56044b3
SSDEEP 3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

warzonerat

Malware Config

Extracted

Family

warzonerat

146.70.143.154:5200

Signatures

Warzonerat family
warzonerat

File Explorer

f1f4236ceb4c0b97583de4744e4f30b5.exe

.exe 152KB

f1f4236ceb4c0b97583de4744e4f30b5.exe

IMPHASH b9494f92817e4dfbe294ad842e8f1988
SHA256 0fb4fd33e3c5368794c0f8e8d5556ef25f1fc808e8db64c9b45e7949e6ee4736
MD5 f1f4236ceb4c0b97583de4744e4f30b5
SHA1 41e8585656af94ba33b1810eadecf30dc9a42fb4
SHA512 06ddd7b3c06fc7984195c27246759aa5a51a45447909f3ab67bee217491f0eb5e285227e22bd1111ccaa25c7c3c29e61fa484293e0651c77f0146566a56044b3
SSDEEP 3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

24104

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

bcrypt

BCryptGenerateSymmetricKey BCryptDecrypt BCryptSetProperty BCryptOpenAlgorithmProvider

ntdll

NtQueryInformationProcess RtlInitUnicodeString RtlEqualUnicodeString

kernel32

GetModuleHandleA GetCommandLineA GetStartupInfoA HeapFree VirtualAlloc HeapReAlloc VirtualQuery TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread CreateProcessA WriteFile CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA GetFullPathNameA GetTempPathW GetPrivateProfileStringW CreateFileA GlobalAlloc GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx LocalAlloc lstrcmpW WaitForSingleObject CreateProcessW VirtualProtect SetFilePointer ReadProcessMemory VirtualQueryEx GetModuleHandleW IsWow64Process WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent ExitProcess GetModuleFileNameW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW GetLogicalDriveStringsW DeleteFileW CopyFileW GetDriveTypeW EnterCriticalSection GetTickCount InitializeCriticalSection DeleteCriticalSection CreateMutexA ReleaseMutex TerminateProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW WinExec Wow64DisableWow64FsRedirection GetSystemDirectoryW Wow64RevertWow64FsRedirection Process32First Process32Next SizeofResource GetTempPathA LockResource lstrcpyW WideCharToMultiByte lstrcpyA Sleep MultiByteToWideChar lstrcatA lstrcmpA lstrlenA ExpandEnvironmentStringsW lstrlenW CloseHandle lstrcatW GetLastError VirtualFree SetLastError GetModuleFileNameA CreateDirectoryW GetProcAddress LoadLibraryA GetProcessHeap CreateEventA HeapAlloc LocalFree LeaveCriticalSection

user32

CreateDesktopW CharLowerW GetKeyState GetMessageA DispatchMessageA CreateWindowExW CallNextHookEx GetAsyncKeyState RegisterClassW GetRawInputData MapVirtualKeyA DefWindowProcA RegisterRawInputDevices TranslateMessage wsprintfA GetKeyNameTextW PostQuitMessage MessageBoxA GetLastInputInfo GetForegroundWindow GetWindowTextW ToUnicode wsprintfW

advapi32

LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid LookupAccountSidW GetTokenInformation QueryServiceStatusEx InitializeSecurityDescriptor RegDeleteKeyA SetSecurityDescriptorDacl RegCreateKeyExW RegSetValueExA RegDeleteValueW RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW CloseServiceHandle RegDeleteKeyW

shell32

SHFileOperationW ShellExecuteExW SHGetSpecialFolderPathW SHCreateDirectoryExW ShellExecuteW SHGetKnownFolderPath ShellExecuteExA SHGetFolderPathW

urlmon

URLDownloadToFileW

ws2_32

getaddrinfo setsockopt freeaddrinfo htons recv connect socket send WSAStartup shutdown closesocket WSACleanup InetNtopW gethostbyname inet_addr

ole32

CoInitialize CoUninitialize CoCreateInstance CoInitializeSecurity CoTaskMemFree

shlwapi

PathFileExistsW PathFindExtensionW StrStrW PathRemoveFileSpecA StrStrA PathCombineA PathFindFileNameW AssocQueryStringW

netapi32

NetLocalGroupAddMembers NetUserAdd

oleaut32

VariantInit

crypt32

CryptUnprotectData CryptStringToBinaryA CryptStringToBinaryW

psapi

GetModuleFileNameExW