Warzone RAT | Files
Logo
Try VMRay Analyzer
VTI SCORE: 100/100
Dynamic Analysis Report
Classification:
Spyware
Threat Names:
Trojan.GenericKDZ.70656

v5vYBIG3hWD7d5JW.exe

Windows Exe (x86-32)

Created at 2020-10-12T12:22:00

...

Remarks (2/2)

(0x0200000E): The overall sleep time of all monitored processes was truncated from "47 minutes, 52 seconds" to "4 minutes" to reveal dormant functionality.

(0x02000004): The operating system was rebooted during the analysis because the sample installed a startup script, task or application for persistence.

Remarks

(0x0200000C): The maximum memory dump size was exceeded. Some dumps may be missing in the report.

Filters:
Filename Category Type Severity Actions
C:\Users\5p5NrGJn0jS HALPmcxz\Desktop\v5vYBIG3hWD7d5JW.exe Sample File Binary
Malicious
...
»
Also Known As C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\images.exe (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\ChFIQxtpqP.exe (Dropped File)
C:\ProgramData\images.exe (Dropped File)
Mime Type application/vnd.microsoft.portable-executable
File Size 733.00 KB
MD5 8bd1629331740f9a2bb0c2a5934844ff Copy to Clipboard
SHA1 413a9890eb88ef44c4d420933a104e54c335d3fa Copy to Clipboard
SHA256 b3fcafa6d8b16ff280ad480b4f8da6775de02d34846e708c073abce41b793505 Copy to Clipboard
SSDeep 12288:7MOLngfkP85sYwNuri5T61wVRvyj3v0Iq3pTGn9aITG64F0icn:BL0kP8SY0T61wfaQlGbRecn Copy to Clipboard
ImpHash f34d5f2d4577ed6d9ceec516c1f5a744 Copy to Clipboard
File Reputation Information
»
Severity
Blacklisted
PE Information
»
Image Base 0x400000
Entry Point 0x4b770e
Size Of Code 0xb5800
Size Of Initialized Data 0x1a00
File Type FileType.executable
Subsystem Subsystem.windows_gui
Machine Type MachineType.i386
Compile Timestamp 2020-10-12 02:06:37+00:00
Version Information (11)
»
Assembly Version 15.0.0.0
Comments Cadbury Gifts Direct.
CompanyName -
FileDescription Toblerone
FileVersion 15.0.0.0
InternalName ر的.exe
LegalCopyright Copyright © 2014 Patchi
LegalTrademarks Patchi
OriginalFilename ر的.exe
ProductName Toblerone
ProductVersion 15.0.0.0
Sections (3)
»
Name Virtual Address Virtual Size Raw Data Size Raw Data Offset Flags Entropy
.text 0x402000 0xb5714 0xb5800 0x200 IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ 7.76
.rsrc 0x4b8000 0x1800 0x1800 0xb5a00 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ 5.03
.reloc 0x4ba000 0xc 0x200 0xb7200 IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ 0.1
Imports (1)
»
mscoree.dll (1)
»
API Name Ordinal IAT Address Thunk RVA Thunk Offset Hint
_CorExeMain 0x0 0x402000 0xb76e4 0xb58e4 0x0
Icons (1)
»
Memory Dumps (164)
»
Name Process ID Start VA End VA Dump Reason PE Rebuild Bitness Entry Point AV YARA Actions
v5vybig3hwd7d5jw.exe 1 0x013E0000 0x0149BFFF Relevant Image True 32-bit - False False
...
buffer 1 0x057C0400 0x058247FF Marked Executable False 32-bit - False False
...
buffer 1 0x057C0178 0x057C017F Marked Executable False 32-bit - False False
...
buffer 1 0x057C01A0 0x057C01A7 Marked Executable False 32-bit - False False
...
buffer 1 0x057C01C8 0x057C01CF Marked Executable False 32-bit - False False
...
buffer 1 0x057C01F0 0x057C01F7 Marked Executable False 32-bit - False False
...
buffer 1 0x057C0218 0x057C021F Marked Executable False 32-bit - False False
...
buffer 1 0x0582512E 0x05825138 Marked Executable False 32-bit - False False
...
buffer 1 0x05825122 0x0582512C Marked Executable False 32-bit - False False
...
buffer 1 0x05824800 0x05824847 Marked Executable False 32-bit - False False
...
buffer 1 0x0582513C 0x0582513F Marked Executable False 32-bit - False False
...
buffer 1 0x05825160 0x05825167 Marked Executable False 32-bit - False False
...
buffer 1 0x05825168 0x0582516B Marked Executable False 32-bit - False False
...
buffer 1 0x0582516C 0x05825173 Marked Executable False 32-bit - False False
...
buffer 1 0x05825174 0x05825177 Marked Executable False 32-bit - False False
...
buffer 1 0x05825178 0x0582517B Marked Executable False 32-bit - False False
...
buffer 1 0x0582517C 0x0582517F Marked Executable False 32-bit - False False
...
buffer 1 0x05825180 0x05825187 Marked Executable False 32-bit - False False
...
buffer 1 0x05825188 0x0582518B Marked Executable False 32-bit - False False
...
buffer 1 0x0582518C 0x05825193 Marked Executable False 32-bit - False False
...
buffer 1 0x05825194 0x05825197 Marked Executable False 32-bit - False False
...
buffer 1 0x05825198 0x0582519B Marked Executable False 32-bit - False False
...
buffer 1 0x0582519C 0x058251A3 Marked Executable False 32-bit - False False
...
buffer 1 0x058251A4 0x058251A7 Marked Executable False 32-bit - False False
...
buffer 1 0x058251A8 0x058251AB Marked Executable False 32-bit - False False
...
buffer 1 0x058251AC 0x058251B3 Marked Executable False 32-bit - False False
...
buffer 1 0x058251B4 0x058251B7 Marked Executable False 32-bit - False False
...
buffer 1 0x058251B8 0x058251BB Marked Executable False 32-bit - False False
...
buffer 1 0x058251BC 0x058251C3 Marked Executable False 32-bit - False False
...
buffer 1 0x058251C4 0x058251C7 Marked Executable False 32-bit - False False
...
buffer 1 0x058251C8 0x058251CB Marked Executable False 32-bit - False False
...
buffer 1 0x058251CC 0x058251CF Marked Executable False 32-bit - False False
...
buffer 1 0x058251D0 0x058251D7 Marked Executable False 32-bit - False False
...
buffer 1 0x058251D8 0x058251DB Marked Executable False 32-bit - False False
...
buffer 1 0x058251DC 0x058251DF Marked Executable False 32-bit - False False
...
buffer 1 0x058251E0 0x058251E7 Marked Executable False 32-bit - False False
...
buffer 1 0x058251E8 0x058251EB Marked Executable False 32-bit - False False
...
buffer 1 0x058251EC 0x058251EF Marked Executable False 32-bit - False False
...
v5vybig3hwd7d5jw.exe 1 0x013E0000 0x0149BFFF Final Dump True 32-bit - False False
...
buffer 5 0x00400000 0x00552FFF First Execution True 32-bit 0x00405907 False False
...
v5vybig3hwd7d5jw.exe 5 0x013E0000 0x0149BFFF Relevant Image True 32-bit - False False
...
v5vybig3hwd7d5jw.exe 1 0x013E0000 0x0149BFFF Process Termination True 32-bit - False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x004011CD False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x00410FCB False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x0040EE5F False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x00411A97 False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x0040E998 False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x0040B6C0 False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x004086F1 False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x0040F530 False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x0040C109 False False
...
buffer 5 0x00400000 0x00552FFF Content Changed True 32-bit 0x00404B7F False False
...
buffer 5 0x02B70000 0x02F70FFF Image In Buffer False 32-bit - True False
...
buffer 7 0x01300400 0x013647FF Marked Executable False 32-bit - False False
...
buffer 7 0x01300178 0x0130017F Marked Executable False 32-bit - False False
...
buffer 7 0x013001A0 0x013001A7 Marked Executable False 32-bit - False False
...
buffer 7 0x013001C8 0x013001CF Marked Executable False 32-bit - False False
...
buffer 7 0x013001F0 0x013001F7 Marked Executable False 32-bit - False False
...
buffer 7 0x01300218 0x0130021F Marked Executable False 32-bit - False False
...
buffer 7 0x0136512E 0x01365138 Marked Executable False 32-bit - False False
...
buffer 7 0x01365122 0x0136512C Marked Executable False 32-bit - False False
...
buffer 7 0x01364800 0x01364847 Marked Executable False 32-bit - False False
...
buffer 7 0x0136513C 0x0136513F Marked Executable False 32-bit - False False
...
buffer 7 0x01365160 0x01365167 Marked Executable False 32-bit - False False
...
buffer 7 0x01365168 0x0136516B Marked Executable False 32-bit - False False
...
buffer 7 0x0136516C 0x01365173 Marked Executable False 32-bit - False False
...
buffer 7 0x01365174 0x01365177 Marked Executable False 32-bit - False False
...
buffer 7 0x01365178 0x0136517B Marked Executable False 32-bit - False False
...
buffer 7 0x0136517C 0x0136517F Marked Executable False 32-bit - False False
...
buffer 7 0x01365180 0x01365187 Marked Executable False 32-bit - False False
...
buffer 7 0x01365188 0x0136518B Marked Executable False 32-bit - False False
...
buffer 7 0x0136518C 0x01365193 Marked Executable False 32-bit - False False
...
buffer 7 0x01365194 0x01365197 Marked Executable False 32-bit - False False
...
buffer 7 0x01365198 0x0136519B Marked Executable False 32-bit - False False
...
buffer 7 0x0136519C 0x013651A3 Marked Executable False 32-bit - False False
...
buffer 7 0x013651A4 0x013651A7 Marked Executable False 32-bit - False False
...
buffer 7 0x013651A8 0x013651AB Marked Executable False 32-bit - False False
...
buffer 7 0x013651AC 0x013651B3 Marked Executable False 32-bit - False False
...
buffer 7 0x013651B4 0x013651B7 Marked Executable False 32-bit - False False
...
buffer 7 0x013651B8 0x013651BB Marked Executable False 32-bit - False False
...
buffer 7 0x013651BC 0x013651C3 Marked Executable False 32-bit - False False
...
buffer 7 0x013651C4 0x013651C7 Marked Executable False 32-bit - False False
...
buffer 7 0x013651C8 0x013651CB Marked Executable False 32-bit - False False
...
buffer 7 0x013651CC 0x013651CF Marked Executable False 32-bit - False False
...
buffer 7 0x013651D0 0x013651D7 Marked Executable False 32-bit - False False
...
buffer 7 0x013651D8 0x013651DB Marked Executable False 32-bit - False False
...
buffer 7 0x013651DC 0x013651DF Marked Executable False 32-bit - False False
...
buffer 7 0x013651E0 0x013651E7 Marked Executable False 32-bit - False False
...
buffer 7 0x013651E8 0x013651EB Marked Executable False 32-bit - False False
...
buffer 7 0x013651EC 0x013651EF Marked Executable False 32-bit - False False
...
buffer 9 0x05BF0400 0x05C547FF Marked Executable False 32-bit - False False
...
buffer 9 0x05BF0178 0x05BF017F Marked Executable False 32-bit - False False
...
buffer 9 0x05BF01A0 0x05BF01A7 Marked Executable False 32-bit - False False
...
buffer 9 0x05BF01C8 0x05BF01CF Marked Executable False 32-bit - False False
...
buffer 9 0x05BF01F0 0x05BF01F7 Marked Executable False 32-bit - False False
...
buffer 9 0x05BF0218 0x05BF021F Marked Executable False 32-bit - False False
...
buffer 9 0x05C5512E 0x05C55138 Marked Executable False 32-bit - False False
...
buffer 9 0x05C55122 0x05C5512C Marked Executable False 32-bit - False False
...
buffer 9 0x05C54800 0x05C54847 Marked Executable False 32-bit - False False
...
buffer 9 0x05C5513C 0x05C5513F Marked Executable False 32-bit - False False
...
buffer 9 0x05C55160 0x05C55167 Marked Executable False 32-bit - False False
...
buffer 9 0x05C55168 0x05C5516B Marked Executable False 32-bit - False False
...
buffer 9 0x05C5516C 0x05C55173 Marked Executable False 32-bit - False False
...
buffer 9 0x05C55174 0x05C55177 Marked Executable False 32-bit - False False
...
buffer 9 0x05C55178 0x05C5517B Marked Executable False 32-bit - False False
...
buffer 9 0x05C5517C 0x05C5517F Marked Executable False 32-bit - False False
...
buffer 9 0x05C55180 0x05C55187 Marked Executable False 32-bit - False False
...
buffer 9 0x05C55188 0x05C5518B Marked Executable False 32-bit - False False
...
buffer 9 0x05C5518C 0x05C55193 Marked Executable False 32-bit - False False
...
buffer 9 0x05C55194 0x05C55197 Marked Executable False 32-bit - False False
...
buffer 9 0x05C55198 0x05C5519B Marked Executable False 32-bit - False False
...
buffer 9 0x05C5519C 0x05C551A3 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551A4 0x05C551A7 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551A8 0x05C551AB Marked Executable False 32-bit - False False
...
buffer 9 0x05C551AC 0x05C551B3 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551B4 0x05C551B7 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551B8 0x05C551BB Marked Executable False 32-bit - False False
...
buffer 9 0x05C551BC 0x05C551C3 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551C4 0x05C551C7 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551C8 0x05C551CB Marked Executable False 32-bit - False False
...
buffer 9 0x05C551CC 0x05C551CF Marked Executable False 32-bit - False False
...
buffer 9 0x05C551D0 0x05C551D7 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551D8 0x05C551DB Marked Executable False 32-bit - False False
...
buffer 9 0x05C551DC 0x05C551DF Marked Executable False 32-bit - False False
...
buffer 9 0x05C551E0 0x05C551E7 Marked Executable False 32-bit - False False
...
buffer 9 0x05C551E8 0x05C551EB Marked Executable False 32-bit - False False
...
buffer 9 0x05C551EC 0x05C551EF Marked Executable False 32-bit - False False
...
buffer 16 0x05880400 0x058E47FF Marked Executable False 32-bit - False False
...
buffer 16 0x05880178 0x0588017F Marked Executable False 32-bit - False False
...
buffer 16 0x058801A0 0x058801A7 Marked Executable False 32-bit - False False
...
buffer 16 0x058801C8 0x058801CF Marked Executable False 32-bit - False False
...
buffer 16 0x058801F0 0x058801F7 Marked Executable False 32-bit - False False
...
buffer 16 0x05880218 0x0588021F Marked Executable False 32-bit - False False
...
buffer 16 0x058E512E 0x058E5138 Marked Executable False 32-bit - False False
...
buffer 16 0x058E5122 0x058E512C Marked Executable False 32-bit - False False
...
buffer 16 0x058E4800 0x058E4847 Marked Executable False 32-bit - False False
...
buffer 16 0x058E513C 0x058E513F Marked Executable False 32-bit - False False
...
buffer 16 0x058E5160 0x058E5167 Marked Executable False 32-bit - False False
...
buffer 16 0x058E5168 0x058E516B Marked Executable False 32-bit - False False
...
buffer 16 0x058E516C 0x058E5173 Marked Executable False 32-bit - False False
...
buffer 16 0x058E5174 0x058E5177 Marked Executable False 32-bit - False False
...
buffer 16 0x058E5178 0x058E517B Marked Executable False 32-bit - False False
...
buffer 16 0x058E517C 0x058E517F Marked Executable False 32-bit - False False
...
buffer 16 0x058E5180 0x058E5187 Marked Executable False 32-bit - False False
...
buffer 16 0x058E5188 0x058E518B Marked Executable False 32-bit - False False
...
buffer 16 0x058E518C 0x058E5193 Marked Executable False 32-bit - False False
...
buffer 16 0x058E5194 0x058E5197 Marked Executable False 32-bit - False False
...
buffer 16 0x058E5198 0x058E519B Marked Executable False 32-bit - False False
...
buffer 16 0x058E519C 0x058E51A3 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51A4 0x058E51A7 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51A8 0x058E51AB Marked Executable False 32-bit - False False
...
buffer 16 0x058E51AC 0x058E51B3 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51B4 0x058E51B7 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51B8 0x058E51BB Marked Executable False 32-bit - False False
...
buffer 16 0x058E51BC 0x058E51C3 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51C4 0x058E51C7 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51C8 0x058E51CB Marked Executable False 32-bit - False False
...
buffer 16 0x058E51CC 0x058E51CF Marked Executable False 32-bit - False False
...
buffer 16 0x058E51D0 0x058E51D7 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51D8 0x058E51DB Marked Executable False 32-bit - False False
...
buffer 16 0x058E51DC 0x058E51DF Marked Executable False 32-bit - False False
...
buffer 16 0x058E51E0 0x058E51E7 Marked Executable False 32-bit - False False
...
buffer 16 0x058E51E8 0x058E51EB Marked Executable False 32-bit - False False
...
buffer 16 0x058E51EC 0x058E51EF Marked Executable False 32-bit - False False
...
Local AV Matches (1)
»
Threat Name Severity
Trojan.GenericKDZ.70656
Malicious
c:\users\5p5nrgjn0js halpmcxz\appdata\local\gdipfontcachev1.dat Modified File Stream
Unknown
...
»
Mime Type application/octet-stream
File Size 106.27 KB
MD5 92e128dcb152d05f07faf5da64bd1c91 Copy to Clipboard
SHA1 2174814ca563fc2b9679fffbf1b40bdf3ac9abec Copy to Clipboard
SHA256 11437a99f5f9c0a6df09c64abc8828ad3ecd8cf4fa601340ded86b8945edff43 Copy to Clipboard
SSDeep 768:i8HrbdvVyZHgTl7ho5sZWN/Ys9byFRQ+AwqGuGyZoVyOF7rrlqTIyMnm:/pVyZHgTl7h6tKR7AwqlGyZQVO1Mnm Copy to Clipboard
ImpHash -
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\tmpF0A4.tmp Dropped File Text
Unknown
...
»
Also Known As C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\tmpF047.tmp (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\tmp40F5.tmp (Dropped File)
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Temp\tmp1B7B.tmp (Dropped File)
Mime Type text/xml
File Size 1.65 KB
MD5 000b8c25038229e5a6fd5e1c931f4503 Copy to Clipboard
SHA1 9364a59bc37c85fac4f621b4b76b4266a8fd0359 Copy to Clipboard
SHA256 3d3ea3644f09a0835c4c5b9b5fccf2778806b598b48769882b72af8578ca4fbc Copy to Clipboard
SSDeep 48:cbhkN76glNQiw/rydbz9I3YODOLNdq3Mm:yhkNe9iw/rydbz9ddq3Mm Copy to Clipboard
ImpHash -
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\aIBiywy.tmp Dropped File Sqlite
Unknown
...
»
Also Known As C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Default\Login Data (Dropped File)
Mime Type application/x-sqlite3
File Size 18.00 KB
MD5 29844404ae855e9df054833f71888eb1 Copy to Clipboard
SHA1 3e86f08def08fc14ddec0227d0643319562666db Copy to Clipboard
SHA256 c381401ea96dfe9b926126dcbbc0dd6ab541dbf549732cc6c66f20096b1f663e Copy to Clipboard
SSDeep 24:LLijhJ0KL7G0TMJHUyyJtmCm0u6lOKQAE9V8FsffDVOzeCmly6UwcTa/HMQW:wz+JH3yJUhJCVE9V8FsXhFlNU1Ts3W Copy to Clipboard
ImpHash -
C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Roaming\eIdnomH.tmp Dropped File Text
Unknown
...
»
Also Known As C:\Users\5p5NrGJn0jS HALPmcxz\AppData\Local\Google\Chrome\User Data\Local State (Dropped File)
Mime Type text/plain
File Size 66.04 KB
MD5 edea92a7dd66d2e13b1b46414df046ec Copy to Clipboard
SHA1 a7068ec5a41ff158c4ff74381bb5f3ac4774e75b Copy to Clipboard
SHA256 cab40edc26b345bfe6e81b80e50a651419d29cd0e3c93eab9561cc86e6d5a1a6 Copy to Clipboard
SSDeep 1536:jx2yuMjgKRTDow4tRovIkCngQvq783ksXyHrPKu:tWw4tRaCngEu83JCuu Copy to Clipboard
ImpHash -
Exit-Icon
WHOIS Domain Information
Domain Name
WHOIS Response 

       		
      

     

    

   

  

  

  

  

   

    
    

     Function Logfile
    

    

     

      Download-Icon
     

    

    

     Exit-Icon
    

   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    Before
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    After
   

   

    

     

      
       This feature requires an online-connection to the VMRay backend.
      
      

      

      An offline version with limited functionality is also provided.
      

      The offline version is supported only in Mozilla Firefoxwith deactivated setting "security.fileuri.strict_origin_policy".
     

     

    

   

   

    

     
      

       
       
       
       
      

     
     
     
    

   

  

  

   

    
    

     Screenshot
    

    

     Expand-Icon
    

    

     Exit-Icon
    

   

   

    

     icon_left
    

    

     icon_left
    

   

   

   

   

    image