warzonerat | 364-67-0x00000000005A0000-0x00000000006F4000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

364-67-0x00000000005A0000-0x00000000006F4000-memory.dmp
Size

1.3MB
MD5

07163028cb097aaeff6e438fb3c79278
SHA1

1d897620cf189cec5b3e73e426e322ecdcd3f972
SHA256

1b3beffe6e9979eeccef7374a8196c5684e44808be7f2ef5f7a955d1c4169a48
SHA512

9b02b59a0fc45073ae02926eec4068424f964ed9f5b845120f982a5c6e988eade16669ed5705035663c9b51b317cf9377289ef0c32a3099735688b6ffd504b8a
SSDEEP

1536:MgmfjDDZnjdViofTz3JaoMBcSsmzl/3SOP5+L0OVE01:M1dBV//YBcSFzFiOP7OVE0

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

C2

84.38.133.137:5200

Signatures

Warzone RAT payload 1 IoCs

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Files

364-67-0x00000000005A0000-0x00000000006F4000-memory.dmp
.dll windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ