warzonerat | 301d992109e2aae983b23cac33f542e2352525457c59f8a354a03d03fb4bcef0

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 22:25

Target

822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe
Size

98KB
MD5

822fe68adc29d401bbd7a02c20b6c150
SHA1

0ffc8cfa49feadff5241176136643e1ead813203
SHA256

301d992109e2aae983b23cac33f542e2352525457c59f8a354a03d03fb4bcef0
SHA512

e37a1cdc58a0d78ad1d19da3868b51cd097043aa2a1806e3a6ce25eae356d46adde3daea08c010ec7085d669abe8a8d66c056dc64086c22d30c0580c582f49e1
SSDEEP

1536:pASlJtTOFUGowSDxj3SPvcOJOiKy8E91jVEyN:eozpV3SPHJOq8wjVEC

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe

description	pid	process	target process
PID 1892 wrote to memory of 3092	1892	822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe	cmd.exe
PID 1892 wrote to memory of 3092	1892	822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe	cmd.exe
PID 1892 wrote to memory of 3092	1892	822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe	cmd.exe
PID 1892 wrote to memory of 3092	1892	822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe	cmd.exe
PID 1892 wrote to memory of 3092	1892	822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\822fe68adc29d401bbd7a02c20b6c150NeikiAnalytics_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1892

memory/3092-0-0x00000000015A0000-0x00000000015A1000-memory.dmp

Filesize
4KB

Download