warzonerat | 1668-78-0x0000000000400000-0x000000000055C000-memory[.]dmp

General

Target
1668-78-0x0000000000400000-0x000000000055C000-memory.dmp
Size 1.4MB
Sample230602-1arsfaee44
SHA256 37afc25930e30e9b5a7bd1f967d7f4c87cdaf1388e01558c353e5fd03f4ab800
MD5 31c6fa2eaa356330c36c27df45fb1263
SHA1 92a7080b44532217b942abd02ede6b4384d83df6
SHA512 141ccbe42db0a4e0d5ce8a0984555f1ca8401a68a77d2ffd932238a515b2243b3b2e2501dc1894f0f4761554e51587fead4c998bf5f385241e14b72640304f27
SSDEEP 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

C2

91.193.75.154:4449

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1668-78-0x0000000000400000-0x000000000055C000-memory.dmp

File Explorer

1668-78-0x0000000000400000-0x000000000055C000-memory.dmp

.exe 1.4MB

1668-78-0x0000000000400000-0x000000000055C000-memory.dmp

SHA256 37afc25930e30e9b5a7bd1f967d7f4c87cdaf1388e01558c353e5fd03f4ab800
MD5 31c6fa2eaa356330c36c27df45fb1263
SHA1 92a7080b44532217b942abd02ede6b4384d83df6
SHA512 141ccbe42db0a4e0d5ce8a0984555f1ca8401a68a77d2ffd932238a515b2243b3b2e2501dc1894f0f4761554e51587fead4c998bf5f385241e14b72640304f27
SSDEEP 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26526

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing