warzonerat | 680-396-0x00000000003E0000-0x00000000008A4000-memory[.]dmp | Triage

Sharing

General

Target

680-396-0x00000000003E0000-0x00000000008A4000-memory.dmp
Size

4.8MB
MD5

6d42f0dc081ab97f81d7833240c2a5c1
SHA1

f7de17fede1a93bf582d0b11237044e94de7686d
SHA256

807fb3da26bcb82e5c61def82623913dc36c27cffd88dfe47866183a43950206
SHA512

c2fdf4e85b90bcc7c8994686feddd8ca1c162c8b6fd385ae940e807fa624dff0ba9179108d1705537a7203a3c8ae127f7f1aa7559f257805d0b0a5135007af0c
SSDEEP

1536:hstZ8g5TVjVdvplDKwcXmU987wIuzE8es+J7Ov94paO0OVE01:QrdhlDUiLaE8eN9Ova+OVE0

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

C2

104.223.19.96:5200

Signatures

Warzone RAT payload 1 IoCs

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
680-396-0x00000000003E0000-0x00000000008A4000-memory.dmp

Files

680-396-0x00000000003E0000-0x00000000008A4000-memory.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ