7c4f34556d1064cbe1889b7d6567b6f8baccaa9d33c18b18f7a2dfb0458484d1 | Triage

Analysis

max time kernel
116s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230221-en
resource tags

arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
submitted
26-03-2023 23:12

Sharing

Report Analysis Logs

General

Target

WARZONE RAT 3.03/cratclient.exe
Size

131KB
MD5

aedb2e69d91d2c8aff792e5c0b2396a0
SHA1

28425bd65bef2ba27b7ac372ba9bab189a27a4e7
SHA256

e76b0d04117daa58544d87b69427aaa6a78d90461470a2a55c80616842180451
SHA512

c5216fccb6b42904f220c098da91c47ab57f6f0d4cd785b09edeeb343aa226a07f139b0c446c636bd035e1584a0b38b6b3ec7030b3cc005e7b34832cbf45630f
SSDEEP

3072:U7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:UwpsERzGKurEXCzeLT7a

Score

3^/10

Malware Config

Signatures

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4756 1268 WerFault.exe cratclient.exe

C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\cratclient.exe
"C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\cratclient.exe"
1⤵
PID:1268

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1268 -s 912
2⤵
- Program crash
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1268 -ip 1268
1⤵
PID:2176

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...