warzonerat | f56ad324836a6a6972ef4555f0dd784642245853d53e7ca4ace87fd3ba7cc38a

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/12/2023, 05:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

716159a91976e085ee0f54b893478480.exe
Size

2.4MB
MD5

716159a91976e085ee0f54b893478480
SHA1

75a9dedcda80e3aa0588f1e296f7ad88692c639b
SHA256

f56ad324836a6a6972ef4555f0dd784642245853d53e7ca4ace87fd3ba7cc38a
SHA512

27e6e5f4611a776ea29fa4ad8b17d0b308021b524fc6d96e170d8c8fcc66fc10e3c702f23ccd85541ad1c73ca7120f1d45cdbc8bbe7b045bbb4b9882fb712386
SSDEEP

12288:2C8DijwX6cEf5CLa5ZLeOiiEuuYHYXWKS3MwWwFgNVPWlGgBeO+D4pa7+ooq5ryV:2LeP0k+WKS3TWwFgNVelhBO5mV

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

oxb2021.ddns.net:2024

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3796-3-0x0000000002D60000-0x0000000003760000-memory.dmp	warzonerat
behavioral2/memory/3796-1-0x0000000003760000-0x00000000038B4000-memory.dmp	warzonerat
behavioral2/memory/3796-12-0x0000000003760000-0x00000000038B4000-memory.dmp	warzonerat
behavioral2/memory/2884-16-0x0000000003880000-0x00000000039D4000-memory.dmp	warzonerat

Executes dropped EXE 1 IoCs

pid	Process
2884	oxb.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 2884	3796	716159a91976e085ee0f54b893478480.exe	94
PID 3796 wrote to memory of 2884	3796	716159a91976e085ee0f54b893478480.exe	94
PID 3796 wrote to memory of 2884	3796	716159a91976e085ee0f54b893478480.exe	94
PID 2884 wrote to memory of 4404	2884	oxb.exe	98
PID 2884 wrote to memory of 4404	2884	oxb.exe	98
PID 2884 wrote to memory of 4404	2884	oxb.exe	98
PID 2884 wrote to memory of 4404	2884	oxb.exe	98
PID 2884 wrote to memory of 4404	2884	oxb.exe	98

C:\Users\Admin\AppData\Local\Temp\716159a91976e085ee0f54b893478480.exe
"C:\Users\Admin\AppData\Local\Temp\716159a91976e085ee0f54b893478480.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3796
- C:\ProgramData\oxb.exe
  "C:\ProgramData\oxb.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:4404

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\oxb.exe

Filesize
229KB

MD5
d1114690e0d0ab49c2cd5716d138f43c

SHA1
f07d05101d8dc584470b32ecf4fca843dfadbf3d

SHA256
a2fac1d571ffeb80e1aa2b0c22170c6d0344d8717ac1c2fec5b0258092070ea2

SHA512
a35d14e13cdf5f5711a3e28e050baa717c0f67ae1af3118a09a93d9c85b8be8bb1c8788e525f357ed425e5509c26cc716e6052c5e8ba6620880ff87997bc0b61

Download Submit
C:\ProgramData\oxb.exe

Filesize
341KB

MD5
658c2743d875e7e48a48685adf8ba76e

SHA1
9a3ef1dae88484578fda09977c5e2fa41cda46f2

SHA256
3ee8bb57705df682aa0160abc6f6bc5849c9acea59b158131f9b62a38171b4bc

SHA512
0912ddc4cc22b9a284e16252cf77be93c6e11bc60527b0022c6658a377983ce8d9dd0a03989d0e8acf3058d5acef9607a1c0cf95efe81d42d22bbd2f262cb209

Download Submit
memory/2884-15-0x0000000076870000-0x0000000076A10000-memory.dmp

Filesize
1.6MB

Download
memory/2884-16-0x0000000003880000-0x00000000039D4000-memory.dmp

Filesize
1.3MB

Download
memory/2884-25-0x0000000076870000-0x0000000076A10000-memory.dmp

Filesize
1.6MB

Download
memory/3796-0-0x0000000076870000-0x0000000076A10000-memory.dmp

Filesize
1.6MB

Download
memory/3796-3-0x0000000002D60000-0x0000000003760000-memory.dmp

Filesize
10.0MB

Download
memory/3796-1-0x0000000003760000-0x00000000038B4000-memory.dmp

Filesize
1.3MB

Download
memory/3796-13-0x0000000076870000-0x0000000076A10000-memory.dmp

Filesize
1.6MB

Download
memory/3796-12-0x0000000003760000-0x00000000038B4000-memory.dmp

Filesize
1.3MB

Download
memory/4404-23-0x00000000003E0000-0x00000000003E1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads