warzonerat | 1668-63-0x0000000000400000-0x000000000055A000-memory[.]dmp

General

Target
1668-63-0x0000000000400000-0x000000000055A000-memory.dmp
Size 1.4MB
Sample230606-ctlhrsbf96
SHA256 5586a5a82d8fa52bd52422690d5d8e79c4554a5a1b0fc595948783f90eccabde
MD5 69d119558588daf29fdb9795d40e0d5b
SHA1 2b511b0bad90134152e1e64087bfd1e5f13b9ead
SHA512 34d3b21a47ef104b2a77c50fbef55e06f15db1521d65aa548ca47d0e91108a706da29644224f1b90141c7e4e10185422644937c839db0b878f571d0a48efbf85
SSDEEP 3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

C2

194.180.48.228:5200

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1668-63-0x0000000000400000-0x000000000055A000-memory.dmp

File Explorer

1668-63-0x0000000000400000-0x000000000055A000-memory.dmp

.exe 1.4MB

1668-63-0x0000000000400000-0x000000000055A000-memory.dmp

SHA256 5586a5a82d8fa52bd52422690d5d8e79c4554a5a1b0fc595948783f90eccabde
MD5 69d119558588daf29fdb9795d40e0d5b
SHA1 2b511b0bad90134152e1e64087bfd1e5f13b9ead
SHA512 34d3b21a47ef104b2a77c50fbef55e06f15db1521d65aa548ca47d0e91108a706da29644224f1b90141c7e4e10185422644937c839db0b878f571d0a48efbf85
SSDEEP 3072:K7W9jps0Tx4azG6GweOTir5axbjNCz45LT7a:KwpsERzGKurEXCzeLT7a
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28068

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing