warzonerat | df836d1a7d4978570ac98b09b91506057186ed7b55ac9f9d119ce263ca19c6a5

Analysis

max time kernel
146s
max time network
121s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
01-06-2024 02:53

Target

8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe
Size

98KB
MD5

8abb6b8dbe611ceba61027fc0b3a5c70
SHA1

9246f4aad385e9de7ca6bdc198d83fc5be7e0141
SHA256

df836d1a7d4978570ac98b09b91506057186ed7b55ac9f9d119ce263ca19c6a5
SHA512

c4a492145b188323e1f6ac274f567ea98e8de5173d84675c8bfe820c6a9eb188ed710e7f457741b6c0c8441d80375e1d70db90e67d2107ab28fbd7f0e6afb34b
SSDEEP

1536:LCsijmb+6BQyusX1UjtA0uWRf/elocD9F1jVEyO:GxD6jSm0uWRfCowFjVEJ

Score

10^/10

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe

description	pid	process	target process
PID 2740 wrote to memory of 1696	2740	8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe	cmd.exe
PID 2740 wrote to memory of 1696	2740	8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe	cmd.exe
PID 2740 wrote to memory of 1696	2740	8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe	cmd.exe
PID 2740 wrote to memory of 1696	2740	8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe	cmd.exe
PID 2740 wrote to memory of 1696	2740	8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe	cmd.exe
PID 2740 wrote to memory of 1696	2740	8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\8abb6b8dbe611ceba61027fc0b3a5c70_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2740

memory/1696-2-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download
memory/1696-0-0x00000000000B0000-0x00000000000B1000-memory.dmp

Filesize
4KB

Download