warzonerat | 6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 22:29

Target

6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe
Size

98KB
MD5

51b355d80b2bd090937326407580badb
SHA1

ce5ca4a30d64bafe9aac3680210b8fac25f419f9
SHA256

6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392
SHA512

bb45f5a55c1ef07ad45a978a13cae3122b31ca58aa3a46ee597c79ea9cab8b2f53e3fe63dc91815fc4fac943a4bd1d5d8c610dfaf73e792f933b8cb3ea085e53
SSDEEP

1536:b60eDNKgTAgkw+BMrtU4FxW5Aku5is1jVEyX:Ol3ThS4FxeAJRjVE8

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe

description	pid	process	target process
PID 4432 wrote to memory of 3200	4432	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 4432 wrote to memory of 3200	4432	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 4432 wrote to memory of 3200	4432	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 4432 wrote to memory of 3200	4432	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe
PID 4432 wrote to memory of 3200	4432	6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe
"C:\Users\Admin\AppData\Local\Temp\6446ca15df9ea1d91e1e13bd269892436dd70cfc95c7b5fa1a7ed6c7671fb392.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4432

memory/3200-0-0x0000000001450000-0x0000000001451000-memory.dmp

Filesize
4KB

Download