Behavioral task
behavioral1
Sample
3376-149-0x0000000010680000-0x00000000107EA000-memory.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
3376-149-0x0000000010680000-0x00000000107EA000-memory.exe
Resource
win10v2004-20230220-en
General
-
Target
3376-149-0x0000000010680000-0x00000000107EA000-memory.dmp
-
Size
1.4MB
-
MD5
94155f70cb5ead440774c75720857774
-
SHA1
3c6d7fe16b8ceaa51dd2417d9532242aca3edbea
-
SHA256
9123c06f9d0058b3fc1ef15d56a41eb90135dbaba4a25f74e70c69e83852ba6b
-
SHA512
defbe8167ad25d75134730d5b2728eaeee2739387e145f3bf81ed77665eaef1a668df6fae3d522d417f49fac686b566af0e0bbdace94927300c8fa675d67332c
-
SSDEEP
3072:HzPtbXqn6aR97tie5Niae2vl23G3Fzyffz8LTDh:Hz1bXq6aR97ViJ2vlz9yffz8LT
Malware Config
Signatures
-
Warzone RAT payload 1 IoCs
resource yara_rule sample warzonerat -
Warzonerat family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 3376-149-0x0000000010680000-0x00000000107EA000-memory.dmp
Files
-
3376-149-0x0000000010680000-0x00000000107EA000-memory.dmp.exe windows x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
.text Size: 192KB - Virtual size: 1.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE