warzonerat | 469301f8da3a3ddf892007d92eb5df11810dc36dd9487014073ac49f4bdb70e5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08-03-2024 02:02

Target

ba3d2569f715cba001a95907847740c5.exe
Size

152KB
MD5

ba3d2569f715cba001a95907847740c5
SHA1

6110a97db563b5044e38f45fc420ae5669b8ba9c
SHA256

469301f8da3a3ddf892007d92eb5df11810dc36dd9487014073ac49f4bdb70e5
SHA512

e0fe62a76ba3c111d11f209ddfdfdf5650a6d4d797791d48f1f4b6db2193d676e207591c97e95d9e0ba2d77460f2286abe99c93fe0a98761629fac30f7a2b751
SSDEEP

3072:4NLOpnhTdOw9YAJOzIY9gVl01T2ENipdDg0z5:4NLYdT97JSIFl0QENqF

Score

10^/10

Family

warzonerat

kezlkelz.duckdns.org:8888

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests.

Processes:

resource	yara_rule
C:\ProgramData\images.exe	BazaLoader

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 1 IoCs

rat

Processes:

resource	yara_rule
C:\ProgramData\images.exe	warzonerat

Executes dropped EXE 1 IoCs

Processes:

images.exe

pid process

1896 images.exe

pid	process
1896	images.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

ba3d2569f715cba001a95907847740c5.exe

description	pid	process	target process
PID 2840 wrote to memory of 1896	2840	ba3d2569f715cba001a95907847740c5.exe	images.exe
PID 2840 wrote to memory of 1896	2840	ba3d2569f715cba001a95907847740c5.exe	images.exe
PID 2840 wrote to memory of 1896	2840	ba3d2569f715cba001a95907847740c5.exe	images.exe

C:\Users\Admin\AppData\Local\Temp\ba3d2569f715cba001a95907847740c5.exe
"C:\Users\Admin\AppData\Local\Temp\ba3d2569f715cba001a95907847740c5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2840

C:\ProgramData\images.exe
"C:\ProgramData\images.exe"
2⤵
- Executes dropped EXE
PID:1896

C:\ProgramData\images.exe
Filesize
152KB

MD5
ba3d2569f715cba001a95907847740c5

SHA1
6110a97db563b5044e38f45fc420ae5669b8ba9c

SHA256
469301f8da3a3ddf892007d92eb5df11810dc36dd9487014073ac49f4bdb70e5

SHA512
e0fe62a76ba3c111d11f209ddfdfdf5650a6d4d797791d48f1f4b6db2193d676e207591c97e95d9e0ba2d77460f2286abe99c93fe0a98761629fac30f7a2b751

Download Submit