warzonerat | 56813940x0000000000400000[.]dmp | Triage

Sharing

Copy URL Twitter E-mail

General

Target

56813940x0000000000400000.dmp
Size

1.4MB
MD5

2e783be954e16ea823f1e5a3315a5012
SHA1

94f64362940047fb9c0e994abb87881bbde908da
SHA256

d3c19a9db0ad6744d68110100836cf56ccd529f0e8208d3a0b729f7e32b1fcbe
SHA512

ec3b6822f02227f8ec7460aff750d1317c193c998ab2d37e53db23a50fd5f3da64cabd0d132e5a129e50ddfd5e83e9f4686aab77ccf9e2c74155627d029556a3
SSDEEP

3072:4NLOpnhTdOw9YAJOzIYpgVl01T2ENipdDT0z5:4NLYdT97JSI9l0QENqs

Score

10^/10

rat warzonerat

Malware Config

Signatures

Warzone RAT payload 1 IoCs

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56813940x0000000000400000.dmp

Files

56813940x0000000000400000.dmp
.exe windows x86

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Sections

.text
Size: 84KB - Virtual size: 84KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 42KB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.bss
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ