warzonerat | 8331[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
8331.exe
Size 141KB
Sample230701-prrm8agg74
SHA256 c522c8ec25a1719e1063f29c749a69a75fdb7e576c9f0e9b25ee5609dc2ec46a
MD5 d709d75ec3eea77f82e97761ee46669c
SHA1 05301829945ae854b0102a357997467646d7bfe5
SHA512 f6f64dce0c6675910961d5eab9104e7bcb32c4ebc49c1168c7f716c45eb6e433575736973febbf62a8c2ed86d31b123e8fc2ec17b49e7633dc868595410a7bea
SSDEEP 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

wrzone-srvr-connector-port.windows-updates.co:8331

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8331.exe

File Explorer

8331.exe

.exe 141KB

8331.exe

IMPHASH 0145d2c473bdbcd7b46a054bd6893ec4
SHA256 c522c8ec25a1719e1063f29c749a69a75fdb7e576c9f0e9b25ee5609dc2ec46a
MD5 d709d75ec3eea77f82e97761ee46669c
SHA1 05301829945ae854b0102a357997467646d7bfe5
SHA512 f6f64dce0c6675910961d5eab9104e7bcb32c4ebc49c1168c7f716c45eb6e433575736973febbf62a8c2ed86d31b123e8fc2ec17b49e7633dc868595410a7bea
SSDEEP 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwj:2dx3wqz3ZcDeDKYzqG01wj
MD5 SHA1 SHA512 SSDEEP

windows x86

Warzone RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26526

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveInClose waveInAddBuffer waveInStart waveInStop waveInPrepareHeader waveInUnprepareHeader waveInOpen

webservices

WsFileTimeToDateTime

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

kernel32

GetTickCount HeapAlloc GetProcessHeap GetCommandLineA GetStartupInfoA HeapFree VirtualAlloc HeapReAlloc VirtualQuery LocalAlloc LocalFree SystemTimeToFileTime TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread GetModuleHandleW IsWow64Process WriteFile WaitForSingleObject CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA lstrcpyW CreateFileA GlobalAlloc GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent CreateProcessW CreateEventA GetModuleFileNameW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateMutexA ReleaseMutex TerminateProcess K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32NextW Process32FirstW DeleteFileW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW GlobalLock GlobalUnlock Process32First Process32Next WideCharToMultiByte lstrcpyA Sleep MultiByteToWideChar lstrcatA lstrcmpA lstrlenA ExpandEnvironmentStringsW lstrlenW lstrcmpW CreateProcessA WinExec ExitProcess GetProcAddress CloseHandle lstrcatW LoadLibraryA GetLastError GetPrivateProfileStringW GetModuleHandleA GetTempPathW VirtualFree SetLastError GetModuleFileNameA CreateDirectoryW GetFullPathNameA

user32

GetWindowTextW GetLastInputInfo wsprintfW CharLowerW PostQuitMessage ToUnicode TranslateMessage RegisterRawInputDevices DefWindowProcA MapVirtualKeyA GetRawInputData RegisterClassW GetAsyncKeyState GetKeyboardState CreateWindowExW SetClipboardViewer DispatchMessageA MapVirtualKeyW GetMessageA GetKeyState ReleaseDC GetSystemMetrics GetForegroundWindow OpenClipboard CloseClipboard GetClipboardData GetDC

advapi32

RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid LookupAccountSidW GetTokenInformation RegQueryInfoKeyA RegOpenKeyW CloseServiceHandle SetSecurityDescriptorDacl RegDeleteKeyA InitializeSecurityDescriptor GetUserNameW RegDeleteKeyW RegCreateKeyExW RegSetValueExA RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW RegDeleteValueW

shell32

SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW ord680 SHGetKnownFolderPath

urlmon

URLDownloadToFileW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipSaveImageToFile GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdiplusShutdown

ws2_32

WSAConnect WSAStartup shutdown closesocket WSACleanup connect InetNtopW gethostbyname send socket recv htons freeaddrinfo setsockopt getaddrinfo inet_addr

ole32

CreateStreamOnHGlobal CoInitialize CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeSecurity

shlwapi

AssocQueryStringW StrStrW PathRemoveFileSpecA PathCombineA PathFindFileNameW PathFindExtensionW PathFileExistsW StrStrA

netapi32

NetUserAdd NetApiBufferFree NetUserGetInfo NetLocalGroupAddMembers

oleaut32

VariantInit

crypt32

CryptStringToBinaryW CryptStringToBinaryA CryptUnprotectData

wininet

InternetTimeToSystemTimeA

gdi32

CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject