warzonerat | 171232524697e35246a2c30a489356b87d3c5303ea4c887116c0c70f131b7f9e7ded60e56c137[.]dat-decoded[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
171232524697e35246a2c30a489356b87d3c5303ea4c887116c0c70f131b7f9e7ded60e56c137.dat-decoded.exe
Size 141KB
Sample240405-q75epadg71
SHA256 6f00f39f32bb3556f024b6e877337a8e6ba5a2feda5d1187e85684de23471ff7
MD5 f162051a9bbf0654b6e528b601b048b5
SHA1 19af80d9fb075026bacc9a56aae68d84b36cc123
SHA512 b75fcc6dd1e38bf4810565a055448ae97c882addb19bd272ef1f9a0171588bfdd56459da391968e724af98457905a09a0aa85776eb6d129129fc39355f93df60
SSDEEP 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwjw:2dx3wqz3ZcDeDKYzqG01wjw
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

rat warzonerat

Malware Config

Extracted

Family

warzonerat

wrzn.duckdns.org:45560

Signatures

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
sample	warzonerat

Warzonerat family
warzonerat

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
171232524697e35246a2c30a489356b87d3c5303ea4c887116c0c70f131b7f9e7ded60e56c137.dat-decoded.exe

File Explorer

171232524697e35246a2c30a489356b87d3c5303ea4c887116c0c70f131b7f9e7ded60e56c137.dat-decoded.exe

.exe 141KB

171232524697e35246a2c30a489356b87d3c5303ea4c887116c0c70f131b7f9e7ded60e56c137.dat-decoded.exe

IMPHASH 0145d2c473bdbcd7b46a054bd6893ec4
SHA256 6f00f39f32bb3556f024b6e877337a8e6ba5a2feda5d1187e85684de23471ff7
MD5 f162051a9bbf0654b6e528b601b048b5
SHA1 19af80d9fb075026bacc9a56aae68d84b36cc123
SHA512 b75fcc6dd1e38bf4810565a055448ae97c882addb19bd272ef1f9a0171588bfdd56459da391968e724af98457905a09a0aa85776eb6d129129fc39355f93df60
SSDEEP 3072:2k4aHUBOO36YplMqBB3ZcPxlG+bBsDHqYzHKG0qIwjw:2dx3wqz3ZcDeDKYzqG01wjw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Warzone RAT payload

rat
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26526

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

winmm

waveInClose waveInAddBuffer waveInStart waveInStop waveInPrepareHeader waveInUnprepareHeader waveInOpen

webservices

WsFileTimeToDateTime

bcrypt

BCryptOpenAlgorithmProvider BCryptSetProperty BCryptGenerateSymmetricKey BCryptDecrypt

kernel32

GetTickCount HeapAlloc GetProcessHeap GetCommandLineA GetStartupInfoA HeapFree VirtualAlloc HeapReAlloc VirtualQuery LocalAlloc LocalFree SystemTimeToFileTime TerminateThread CreateThread WriteProcessMemory GetCurrentProcess OpenProcess GetWindowsDirectoryA VirtualProtectEx VirtualAllocEx CreateRemoteThread GetModuleHandleW IsWow64Process WriteFile WaitForSingleObject CreateFileW LoadLibraryW GetLocalTime GetCurrentThreadId GetCurrentProcessId ReadFile FindFirstFileA GetBinaryTypeW FindNextFileA lstrcpyW CreateFileA GlobalAlloc GetCurrentDirectoryW SetCurrentDirectoryW GetFileSize FreeLibrary SetDllDirectoryW GetFileSizeEx WaitForMultipleObjects CreatePipe PeekNamedPipe DuplicateHandle SetEvent CreateProcessW CreateEventA GetModuleFileNameW LoadResource FindResourceW GetComputerNameW GlobalMemoryStatusEx LoadLibraryExW FindFirstFileW FindNextFileW SetFilePointer GetLogicalDriveStringsW CopyFileW GetDriveTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSection DeleteCriticalSection CreateMutexA ReleaseMutex TerminateProcess K32GetModuleFileNameExW CreateToolhelp32Snapshot Process32NextW Process32FirstW DeleteFileW SizeofResource VirtualProtect GetSystemDirectoryW LockResource GetWindowsDirectoryW GlobalLock GlobalUnlock Process32First Process32Next WideCharToMultiByte lstrcpyA Sleep MultiByteToWideChar lstrcatA lstrcmpA lstrlenA ExpandEnvironmentStringsW lstrlenW lstrcmpW CreateProcessA WinExec ExitProcess GetProcAddress CloseHandle lstrcatW LoadLibraryA GetLastError GetPrivateProfileStringW GetModuleHandleA GetTempPathW VirtualFree SetLastError GetModuleFileNameA CreateDirectoryW GetFullPathNameA

user32

GetWindowTextW GetLastInputInfo wsprintfW CharLowerW PostQuitMessage ToUnicode TranslateMessage RegisterRawInputDevices DefWindowProcA MapVirtualKeyA GetRawInputData RegisterClassW GetAsyncKeyState GetKeyboardState CreateWindowExW SetClipboardViewer DispatchMessageA MapVirtualKeyW GetMessageA GetKeyState ReleaseDC GetSystemMetrics GetForegroundWindow OpenClipboard CloseClipboard GetClipboardData GetDC

advapi32

RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid LookupAccountSidW GetTokenInformation RegQueryInfoKeyA RegOpenKeyW CloseServiceHandle SetSecurityDescriptorDacl RegDeleteKeyA InitializeSecurityDescriptor GetUserNameW RegDeleteKeyW RegCreateKeyExW RegSetValueExA RegOpenKeyExW RegOpenKeyExA RegEnumKeyExW RegQueryValueExA RegQueryInfoKeyW RegCloseKey OpenServiceW ChangeServiceConfigW QueryServiceConfigW EnumServicesStatusExW StartServiceW RegSetValueExW RegCreateKeyExA OpenSCManagerW RegDeleteValueW

shell32

SHFileOperationW SHGetSpecialFolderPathW SHCreateDirectoryExW SHGetFolderPathW ShellExecuteW ord680 SHGetKnownFolderPath

urlmon

URLDownloadToFileW

gdiplus

GdiplusStartup GdipGetImageEncoders GdipSaveImageToFile GdipDisposeImage GdipCreateBitmapFromHBITMAP GdipGetImageEncodersSize GdiplusShutdown

ws2_32

WSAConnect WSAStartup shutdown closesocket WSACleanup connect InetNtopW gethostbyname send socket recv htons freeaddrinfo setsockopt getaddrinfo inet_addr

ole32

CreateStreamOnHGlobal CoInitialize CoCreateInstance CoTaskMemFree CoUninitialize CoInitializeSecurity

shlwapi

AssocQueryStringW StrStrW PathRemoveFileSpecA PathCombineA PathFindFileNameW PathFindExtensionW PathFileExistsW StrStrA

netapi32

NetUserAdd NetApiBufferFree NetUserGetInfo NetLocalGroupAddMembers

oleaut32

VariantInit

crypt32

CryptStringToBinaryW CryptStringToBinaryA CryptUnprotectData

wininet

InternetTimeToSystemTimeA

gdi32

CreateCompatibleDC SelectObject CreateCompatibleBitmap BitBlt DeleteObject