warzonerat | d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/03/2024, 19:04

Target

d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe
Size

2.8MB
MD5

49246106665fa0fc369af394866827e3
SHA1

5e1fe81b007e03bb3a1b452e0cee53c87acafcf6
SHA256

d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22
SHA512

6b88ed92d28ea919ead1555c5edd040c74beafd52eae4caaa657f0f54ced97f6af448a68d5b51c5292697da8d543695447a4a0192014a4b4fdeae99550498497
SSDEEP

24576:R5RIyPhqQyjggWCghPaRoK/dq1mbexUjdrbdMM5696lGcl6tdqIGcEVM4b:R53PYXMgpCaRo4ngsdrbdMLQLw

Score

10^/10

Family

warzonerat

dansjueis.3utilities.com:8452

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/4956-1-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat
behavioral2/memory/4956-3-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat
behavioral2/memory/4956-4-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat
behavioral2/memory/4956-5-0x0000000000400000-0x000000000055C000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4648 set thread context of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95
PID 4648 wrote to memory of 4956	4648	d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe	95

C:\Users\Admin\AppData\Local\Temp\d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe
"C:\Users\Admin\AppData\Local\Temp\d129815677ebe39b7bc1d5cab436d3215fc9ade83306bf9d7ba9c48a509dba22.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"
  2⤵
  PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3368 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:3528

memory/4648-0-0x000001C9D1160000-0x000001C9D1170000-memory.dmp

Filesize
64KB

Download
memory/4956-1-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/4956-3-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/4956-4-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download
memory/4956-5-0x0000000000400000-0x000000000055C000-memory.dmp

Filesize
1.4MB

Download