7c4f34556d1064cbe1889b7d6567b6f8baccaa9d33c18b18f7a2dfb0458484d1

Analysis

max time kernel
110s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 23:12

Target

WARZONE RAT 3.03/WARZONE Password Viewer 1.0.exe
Size

615KB
MD5

9437e1958c0ac30e29f23673a8363dca
SHA1

d5dde71d0da6910018a78b023779eb0a960b01e5
SHA256

33f697aeab386599e11efc14a336d131dceb4efe397614b06ad1c592f89d3212
SHA512

0197288326d68d96d91e5f58514dcf0ab6e76dd69b889424d62ca540670c7fd945240f457a244cc49f48ac8b86b335be80812f94cd7b6008aa7f01813cfd36ec
SSDEEP

1536:1gg2zBS5D6aZuAQomeq6Y2mlJ5Tv8gzWNX5D6vZDAQomeK6Y2m9J5Tv8gzW:1gpBMrZuAQrZKgyNRGZDAQXRygC

Score

1^/10

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

WARZONE Password Viewer 1.0.exe

pid process

4828 WARZONE Password Viewer 1.0.exe

pid	process
4828	WARZONE Password Viewer 1.0.exe

C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\WARZONE Password Viewer 1.0.exe
"C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\WARZONE Password Viewer 1.0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4828

memory/4828-133-0x0000000000430000-0x00000000004D0000-memory.dmp

Filesize
640KB

Download
memory/4828-134-0x00000000054F0000-0x0000000005A94000-memory.dmp

Filesize
5.6MB

Download
memory/4828-135-0x0000000004E70000-0x0000000004F06000-memory.dmp

Filesize
600KB

Download
memory/4828-136-0x0000000005320000-0x00000000053B2000-memory.dmp

Filesize
584KB

Download
memory/4828-137-0x00000000052F0000-0x00000000052FA000-memory.dmp

Filesize
40KB

Download
memory/4828-138-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/4828-139-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/4828-140-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download
memory/4828-141-0x0000000005310000-0x0000000005320000-memory.dmp

Filesize
64KB

Download