Behavioral task
behavioral1
Sample
4536-155-0x0000000001300000-0x00000000017E1000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4536-155-0x0000000001300000-0x00000000017E1000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
4536-155-0x0000000001300000-0x00000000017E1000-memory.dmp
-
Size
4.9MB
-
MD5
d4bd4667d7ffa0080d88cfbb40dea68e
-
SHA1
78bbacd4a1553476ac6d76e70f19c3bb59740596
-
SHA256
b7442704afbb1b3b78c2f15a02e098f6d6090146b62d8fac512a40fe90293be9
-
SHA512
954773b6ce7cae179a619158f98934610e649392c10dba1b2e669c033535770559c777e641b7c8f83205c8eaece78587117a23d829e3639c6de8c54c29027f93
-
SSDEEP
3072:bVwaflJH59G567PgUgo4mqjwA6ZVl0tm2ENipdDI0z5:bVwae56jBlqZwl0bENq1
Malware Config
Extracted
warzonerat
198.23.207.34:3333
Signatures
-
Warzonerat family
Files
-
4536-155-0x0000000001300000-0x00000000017E1000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 84KB - Virtual size: 84KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 42KB - Virtual size: 1.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: 4KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.bss Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ