warzonerat | 3968-140-0x0000000000400000-0x000000000055E000-memory[.]dmp

General

Target
3968-140-0x0000000000400000-0x000000000055E000-memory.dmp
Size 1.4MB
Sample230228-m513psaf9v
SHA256 7a3343c560b07b539274e973e6cb73b9fa49bee578e2da8afe1a63d4390e28e9
MD5 3e67eca01da26cdd5f89ab3ab10eef1a
SHA1 9e2d3eb400aea68f62eb7aae85538f49db2e9fd0
SHA512 fe9638fe8a35341bfc215b093aaf7e612f9a105ced0c50b688bd93b55b14741a42840d2a5f8715a220cdda21164b00fa9b6a61d77f28a9e7010cba69e33c49e0
SSDEEP 3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

C2

195.133.40.92:5200

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

File Explorer

3968-140-0x0000000000400000-0x000000000055E000-memory.dmp

.exe 1.4MB

3968-140-0x0000000000400000-0x000000000055E000-memory.dmp

SHA256 7a3343c560b07b539274e973e6cb73b9fa49bee578e2da8afe1a63d4390e28e9
MD5 3e67eca01da26cdd5f89ab3ab10eef1a
SHA1 9e2d3eb400aea68f62eb7aae85538f49db2e9fd0
SHA512 fe9638fe8a35341bfc215b093aaf7e612f9a105ced0c50b688bd93b55b14741a42840d2a5f8715a220cdda21164b00fa9b6a61d77f28a9e7010cba69e33c49e0
SSDEEP 3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat

Minor OS version

Major OS version

Entry point

24104

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing