Overview
overview
10Static
static
10WARZONE RA...er.dll
windows10-2004-x64
1WARZONE RA...er.exe
windows10-2004-x64
1WARZONE RA...ox.dll
windows10-2004-x64
1WARZONE RA...32.dll
windows10-2004-x64
1WARZONE RA...64.dll
windows10-2004-x64
1WARZONE RA...er.exe
windows10-2004-x64
1WARZONE RA...np.exe
windows10-2004-x64
8WARZONE RA...er.exe
windows10-2004-x64
1WARZONE RA...se.dll
windows10-2004-x64
1WARZONE RA...in.dll
windows10-2004-x64
1WARZONE RA...ls.dll
windows10-2004-x64
1WARZONE RA...ne.dll
windows10-2004-x64
1WARZONE RA....0.exe
windows10-2004-x64
1WARZONE RA...ed.exe
windows10-2004-x64
10WARZONE RA...nt.exe
windows10-2004-x64
3WARZONE RA...td.dll
windows10-2004-x64
3Analysis
-
max time kernel
60s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
26-03-2023 23:12
Behavioral task
behavioral1
Sample
WARZONE RAT 3.03/Datas/ServerManager.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral2
Sample
WARZONE RAT 3.03/Datas/SocksManager.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
WARZONE RAT 3.03/Datas/firefox.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral4
Sample
WARZONE RAT 3.03/Datas/rdpwrap32.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral5
Sample
WARZONE RAT 3.03/Datas/rdpwrap64.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral6
Sample
WARZONE RAT 3.03/Datas/rvncviewer.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
WARZONE RAT 3.03/Datas/upnp.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral8
Sample
WARZONE RAT 3.03/Datas/vncviewer.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
WARZONE RAT 3.03/License.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral10
Sample
WARZONE RAT 3.03/MaterialSkin.dll
Resource
win10v2004-20230221-en
Behavioral task
behavioral11
Sample
WARZONE RAT 3.03/PETools.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral12
Sample
WARZONE RAT 3.03/TyWarzone.dll
Resource
win10v2004-20230220-en
Behavioral task
behavioral13
Sample
WARZONE RAT 3.03/WARZONE Password Viewer 1.0.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral14
Sample
WARZONE RAT 3.03/WARZONE-RAT 3.03 Cracked.exe
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
WARZONE RAT 3.03/cratclient.exe
Resource
win10v2004-20230221-en
Behavioral task
behavioral16
Sample
WARZONE RAT 3.03/cratclientd.dll
Resource
win10v2004-20230220-en
General
-
Target
WARZONE RAT 3.03/License.dll
-
Size
959KB
-
MD5
cb63d02b2189eeef93f7abdd88450095
-
SHA1
f8230932af46537195f9f266e7fd657622fe297d
-
SHA256
8e680c2074e5e701174f801125cb438c55a4a65649b4c7307e10de61879cbe65
-
SHA512
c40efb00279f9e2bf4fe81a6dd14785e4d66a50b9955cb80ddb545b5142a293013ff6ea9cbf817e48f6a2e393baf169106f5663e1defddc524c8574374477780
-
SSDEEP
24576:x8ePkxtGwCxgwKE+OqBIqg04hennliOETs:PwE+UIQUIj
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4516 wrote to memory of 4136 4516 rundll32.exe 81 PID 4516 wrote to memory of 4136 4516 rundll32.exe 81 PID 4516 wrote to memory of 4136 4516 rundll32.exe 81
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\License.dll",#11⤵
- Suspicious use of WriteProcessMemory
PID:4516 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\WARZONE RAT 3.03\License.dll",#12⤵PID:4136
-