warzonerat | 6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392

Analysis

max time kernel
146s
max time network
124s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 22:29

Target

6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe
Size

98KB
MD5

51b355d80b2bd090937326407580badb
SHA1

ce5ca4a30d64bafe9aac3680210b8fac25f419f9
SHA256

6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392
SHA512

bb45f5a55c1ef07ad45a978a13cae3122b31ca58aa3a46ee597c79ea9cab8b2f53e3fe63dc91815fc4fac943a4bd1d5d8c610dfaf73e792f933b8cb3ea085e53
SSDEEP

1536:b60eDNKgTAgkw+BMrtU4FxW5Aku5is1jVEyX:Ol3ThS4FxeAJRjVE8

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe

description	pid	process	target process
PID 1728 wrote to memory of 1856	1728	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 1728 wrote to memory of 1856	1728	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 1728 wrote to memory of 1856	1728	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 1728 wrote to memory of 1856	1728	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 1728 wrote to memory of 1856	1728	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 1728 wrote to memory of 1856	1728	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe
"C:\Users\Admin\AppData\Local\Temp\6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1728

memory/1856-2-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/1856-0-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download