warzonerat | 9cbc62093489d2b4a30af703696b730ffd6d1fea9b962c3f81a105271e98b07c

Analysis

max time kernel
182s
max time network
198s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2022 08:58

Target

1588-89-0x0000000010670000-0x00000000107C6000-memory.exe
Size

1.3MB
MD5

6aab07b50cad5b64471c04fcd3383ea4
SHA1

e2a5c4ef5b60089c3582b8db0e75103c91473c98
SHA256

9cbc62093489d2b4a30af703696b730ffd6d1fea9b962c3f81a105271e98b07c
SHA512

28dde1db95ea053309b2657b4b0b15c0bad0b113d70ebdcd8d683b66a8144795fcace47ba952a51184e83b3c08306d8712289d35663c0e97aafec080dcfdd728
SSDEEP

1536:wY0jP7/L1B5rVmN8sxHv2M28ix8EUaJxWZoB4u0OVE01Q:w71VmhaH8EFvW+0OVE0

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
behavioral2/memory/1224-132-0x0000000000660000-0x00000000007B6000-memory.dmp	warzonerat

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5104 1224 WerFault.exe 1588-89-0x0000000010670000-0x00000000107C6000-memory.exe

pid	pid_target	process	target process
5104	1224	WerFault.exe	1588-89-0x0000000010670000-0x00000000107C6000-memory.exe

C:\Users\Admin\AppData\Local\Temp\1588-89-0x0000000010670000-0x00000000107C6000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\1588-89-0x0000000010670000-0x00000000107C6000-memory.exe"
1⤵
PID:1224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1224 -s 216
  2⤵
  - Program crash
  PID:5104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 196 -p 1224 -ip 1224
1⤵
PID:2528

memory/1224-132-0x0000000000660000-0x00000000007B6000-memory.dmp

Filesize
1.3MB

Download