warzonerat | 972-68-0x0000000000290000-0x0000000000847000-memory[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

972-68-0x0000000000290000-0x0000000000847000-memory.dmp
Size

5.7MB
MD5

022d57d076b36a5feab85a3b73789d35
SHA1

7272f6a28888e704c34f464dccf6b7d39afdb3d7
SHA256

54f5e707b503239c183f6d4ffe4200743df43099f7c951f2b45315885d9f433a
SHA512

ddcbd6756bf3278431c8e6ae4ca51b77986ce33aec3d5405dcda3794b501a63846a3951ccfe90700a6f3638559dc921fc8abfcb51621830085ac3783109ab211
SSDEEP

3072:W0y+3s2nqyItt8dO6nb6yIav2vx9HSfzpoLTIh:W0d3s2qyIr6b6yIrzHSfzpoLT

Score

10^/10

rat warzonerat

Malware Config

Signatures

Warzone RAT payload 1 IoCs

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Files

972-68-0x0000000000290000-0x0000000000847000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 146KB - Virtual size: 145KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ