Behavioral task
behavioral1
Sample
2232-139-0x0000000000400000-0x000000000041D000-memory.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
2232-139-0x0000000000400000-0x000000000041D000-memory.exe
Resource
win10v2004-20220812-en
General
-
Target
2232-139-0x0000000000400000-0x000000000041D000-memory.dmp
-
Size
116KB
-
MD5
ba7df87ecac11557718d150d8f1f3da8
-
SHA1
0e04ccfb9f772a64ca7b40b42fafaab10124efcd
-
SHA256
c096fd6804e807b72760cb468cc35dd283ba428f2f3e403f62e2b16a3e5dc03c
-
SHA512
c01af4de79c39181fc6f474061fba302010328a72ad76f0449026b7174fc7b2b44f944e32703469e56589b8b31c0611d3937ae77611cedc8d4fdba2abbb9d330
-
SSDEEP
1536:5Csejmb+6BQyusX1UjtA0uWRf/elocfj9T1jVEyL:AtD6jSm0uWRfCosTjVEs
Malware Config
Extracted
warzonerat
workbro.duckdns.org:1992
Signatures
-
Warzone RAT payload 1 IoCs
resource yara_rule sample warzonerat -
Warzonerat family
Files
-
2232-139-0x0000000000400000-0x000000000041D000-memory.dmp.exe windows x86
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 65KB - Virtual size: 64KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 15KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 1KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 11KB - Virtual size: 11KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.bss Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ