File name:

WARZONE RAT 2.70 POISON - cortexnet.cc.zip.zip

Full analysis: https://app.any.run/tasks/104b316d-b74f-4bfd-9eab-135b470b41a9
Verdict: Malicious activity
Threats:

A loader is malicious software that infiltrates devices to deliver malicious payloads. This malware is capable of infecting victims’ computers, analyzing their system information, and installing other types of threats, such as trojans or stealers. Criminals usually deliver loaders through phishing emails and links by relying on social engineering to trick users into downloading and running their executables. Loaders employ advanced evasion and persistence tactics to avoid detection.

Malware Trends Tracker     >>>
Analysis date: August 28, 2024, 04:59:14
OS: Windows 10 Professional (build: 19045, 64 bit)
Tags:
bazaloader
loader
warzone
Indicators:
MIME: application/zip
File info: Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
MD5:

5E39F89FE83F25CFA0C7C2F7DC95257D

SHA1:

9709F26772ED554EE559E9786A3694C3DF727DB8

SHA256:

58F3AFCCB83796B7C4E123C3041362ED3319B0711A477C28B8DA7DE3AF776ADA

SSDEEP:

98304:Bg6WjTm+JgeaS3lR9sc309lrjSGPPUwAcF9rhfiS+qMlb06Itvwp5LZTfRVO+c20:uMUX0e0MhjZx5DRQd+F/Cg97YXmba

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • BAZALOADER has been detected (YARA)

      • test.exe (PID: 5544)
      • test2.exe (PID: 3184)

    • WARZONE has been detected (YARA)

      • test.exe (PID: 5544)
      • test2.exe (PID: 3184)

    • Create files in the Startup directory

      • test2.exe (PID: 3184)

  • SUSPICIOUS

    • Application launched itself

      • WinRAR.exe (PID: 4996)

    • The process drops Mozilla's DLL files

      • WinRAR.exe (PID: 4996)
      • WinRAR.exe (PID: 5768)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 4996)
      • Warzone Cracked.exe (PID: 3328)
      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)

    • Drops the executable file immediately after the start

      • WinRAR.exe (PID: 4996)
      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
      • test2.exe (PID: 3184)

    • Reads the date of Windows installation

      • Warzone Cracked.exe (PID: 3328)

    • Executable content was dropped or overwritten

      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
      • test2.exe (PID: 3184)

    • Detected use of alternative data streams (AltDS)

      • test2.exe (PID: 3184)

    • The process checks if it is being run in the virtual environment

      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)

  • INFO

    • Manual execution by a user

      • Warzone Cracked.exe (PID: 3328)
      • test.exe (PID: 5544)
      • test2.exe (PID: 3184)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 5768)

    • Reads the machine GUID from the registry

      • Warzone Cracked.exe (PID: 3328)
      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)

    • Reads the computer name

      • Warzone Cracked.exe (PID: 3328)
      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
      • Inject.exe (PID: 6140)
      • test2.exe (PID: 3184)

    • Checks supported languages

      • Warzone Cracked.exe (PID: 3328)
      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
      • Inject.exe (PID: 6140)
      • test.exe (PID: 5544)
      • test2.exe (PID: 3184)

    • Process checks computer location settings

      • Warzone Cracked.exe (PID: 3328)

    • Reads Windows Product ID

      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)

    • Creates files or folders in the user directory

      • WARZONE RAT - HIDDEN POISON 2.70.exe (PID: 6120)
      • test2.exe (PID: 3184)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report

WarZone

(PID) Process(5544) test.exe
C2 (1)127.0.0.0:5200
BuildIDEIM6RXCR8U
Options
Install FlagFalse
Startup FlagFalse
Reverse Proxy local port5000
Offline logFalse
PersistanceFalse
UAC bypassFalse
Defender bypassFalse
Use ADSFalse
(PID) Process(3184) test2.exe
C2 (1)test:5200
BuildIDPIBWQFATZE
Options
Install FlagFalse
Startup FlagFalse
Reverse Proxy local port5000
Offline logFalse
PersistanceFalse
UAC bypassFalse
Defender bypassFalse
Use ADSFalse
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 51
ZipBitFlag: 0x0009
ZipCompression: Unknown (99)
ZipModifyDate: 2024:08:28 04:57:24
ZipCRC: 0x7ba8bf64
ZipCompressedSize: 12162286
ZipUncompressedSize: 12171326
ZipFileName: WARZONE RAT 2.70 POISON - cortexnet.cc.zip
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
133
Monitored processes
9
Malicious processes
3
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe no specs winrar.exe warzone cracked.exe no specs warzone rat - hidden poison 2.70.exe inject.exe no specs conhost.exe no specs conhost.exe no specs #WARZONE test.exe #WARZONE test2.exe

Process information

PID
CMD
Path
Indicators
Parent process
2588\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—Inject.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
3184"C:\Users\admin\Desktop\test2.exe" C:\Users\admin\Desktop\test2.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\test2.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcrypt.dll
WarZone
(PID) Process(3184) test2.exe
C2 (1)test:5200
BuildIDPIBWQFATZE
Options
Install FlagFalse
Startup FlagFalse
Reverse Proxy local port5000
Offline logFalse
PersistanceFalse
UAC bypassFalse
Defender bypassFalse
Use ADSFalse
3328"C:\Users\admin\Desktop\Warzone Cracked.exe" C:\Users\admin\Desktop\Warzone Cracked.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
Warzone Cracked
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\warzone cracked.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
4996"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\Desktop\WARZONE RAT 2.70 POISON - cortexnet.cc.zip.zip"C:\Program Files\WinRAR\WinRAR.exe—explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
5544"C:\Users\admin\Desktop\test.exe" C:\Users\admin\Desktop\test.exe
explorer.exe
User:
admin
Integrity Level:
MEDIUM
Modules
Images
c:\users\admin\desktop\test.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\bcrypt.dll
WarZone
(PID) Process(5544) test.exe
C2 (1)127.0.0.0:5200
BuildIDEIM6RXCR8U
Options
Install FlagFalse
Startup FlagFalse
Reverse Proxy local port5000
Offline logFalse
PersistanceFalse
UAC bypassFalse
Defender bypassFalse
Use ADSFalse
5768"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIb4996.47707\WARZONE RAT 2.70 POISON - cortexnet.cc.zip"C:\Program Files\WinRAR\WinRAR.exe
WinRAR.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
6120"C:\Users\admin\Desktop\WARZONE RAT - HIDDEN POISON 2.70.exe" C:\Users\admin\Desktop\WARZONE RAT - HIDDEN POISON 2.70.exe
Warzone Cracked.exe
User:
admin
Integrity Level:
MEDIUM
Description:
WARZONE RAT - HIDDEN POISON 2.70
Exit code:
0
Version:
2.7.0.0
Modules
Images
c:\users\admin\desktop\warzone rat - hidden poison 2.70.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\mscoree.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
6140"Injector\Inject.exe" -m Main -i "Injector\Warzone.Loader.dll" -l Cortex.Loader -a "jebac bydgoszcz" -n "WARZONE RAT - HIDDEN POISON 2.70.exe"C:\Users\admin\Desktop\Injector\Inject.exe—Warzone Cracked.exe
User:
admin
Company:
Plan A Software
Integrity Level:
MEDIUM
Description:
An unmanaged command line application for injecting the .net runtime and .net assemblies into x86 or x64 unmanaged or managed remote processes.
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\desktop\injector\inject.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\user32.dll
6716\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—WARZONE RAT - HIDDEN POISON 2.70.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
20 298
Read events
20 139
Write events
149
Delete events
10

Modification events

(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\GoogleChromeEnterpriseBundle64.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\WARZONE RAT 2.70 POISON - cortexnet.cc.zip.zip
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\Interface
Operation:writeName:ShowPassword
Value:
0
(PID) Process:(4996) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
Operation:writeName:ProxyBypass
Value:
1
Executable files
22
Suspicious files
5
Text files
13
Unknown types
2

Dropped files

PID
Process
Filename
Type
5768WinRAR.exeC:\Users\admin\Desktop\Datas\rV.bsp1binary
MD5:A23A6C143732E1C83BF09FE71C78AA93
SHA256:E48D338DD5FC668888EB89E6C35E8F4B4F61B4D4BC35574C548A1BC9DBF52054
5768WinRAR.exeC:\Users\admin\Desktop\cratclient.binexecutable
MD5:8DB7B6AA08ECBF107BDB3B8964B69734
SHA256:A60D265E1FFEE14F518BC3F1863C9F3283A0950BAA6AF3E85C558BA1D9BD4EE5
5768WinRAR.exeC:\Users\admin\Desktop\Datas\firefox.dllsexecutable
MD5:A26861558315278D5960FE1BF58B1950
SHA256:B52720863EC78E0F7BFF98E6C809FDF50AB2D0EA361E95EB5341E870AAFB0354
5768WinRAR.exeC:\Users\admin\Desktop\Datas\rdpwrap64.dllexecutable
MD5:C4063372AFE486D5E9A11C5B68E0524F
SHA256:FC1F3FC182CEF9BCEF5192E4FA4569697E27852CBFFB7A55EA6118C603DDC420
5768WinRAR.exeC:\Users\admin\Desktop\cratclientd.binexecutable
MD5:0A1B14F067C724715DA57239B72F40F2
SHA256:8CEFCE92491264087E3F4FB9413DD93B2E53F8BB48EB06FAD7751D4540EFCE8B
5768WinRAR.exeC:\Users\admin\Desktop\Datas\rdpwrap.inibinary
MD5:6BC395161B04AA555D5A4E8EB8320020
SHA256:23390DFCDA60F292BA1E52ABB5BA2F829335351F4F9B1D33A9A6AD7A9BF5E2BE
5768WinRAR.exeC:\Users\admin\Desktop\Datas\rdpwrap32.dllexecutable
MD5:F5C6A32EE3BD88AE44C0C0DFAE950CF0
SHA256:B9828995474F7E6A6B5C160E5160C5FF49495654A5B89654B6A0F9B8664F82FC
5768WinRAR.exeC:\Users\admin\Desktop\Datas\ServerManager.dllexecutable
MD5:CCC5BD0D95F504FCE814E6758D4953D6
SHA256:2B658436167826D3A1E44919A1113C6F1717515BD7EF0064D7152D7C3E050FC1
5768WinRAR.exeC:\Users\admin\Desktop\Datas\rV2.bsp1binary
MD5:7DE0184ED564E0D2076D9B3520E7CCE6
SHA256:4449673175412AACBAB5A485DEAE55DD11B2EFE67A06525DAD05C948542F7387
5768WinRAR.exeC:\Users\admin\Desktop\Datas\rvncviewer.exeexecutable
MD5:27561E722C736AB5A77110790402999B
SHA256:5E49A7FEC8C9F81B191E5FA69BDB1A627814631813FEDFC4136C71E55CD57C0F
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
3
TCP/UDP connections
34
DNS requests
14
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
4164
svchost.exe
GET
200
192.229.221.95:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
1992
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
1992
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:138
—
—
—
whitelisted
6164
svchost.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
2120
MoUsoCoreWorker.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
1084
RUXIMICS.exe
20.73.194.208:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
6164
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
3260
svchost.exe
40.115.3.253:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
4164
svchost.exe
40.126.31.67:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4164
svchost.exe
192.229.221.95:80
ocsp.digicert.com
EDGECAST
US
whitelisted
1992
SIHClient.exe
20.12.23.50:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 20.73.194.208
  • 4.231.128.59
  • 51.124.78.146
whitelisted
google.com
  • 142.250.185.206
whitelisted
client.wns.windows.com
  • 40.115.3.253
whitelisted
login.live.com
  • 40.126.31.67
  • 20.190.159.23
  • 40.126.31.73
  • 20.190.159.68
  • 20.190.159.75
  • 40.126.31.69
  • 20.190.159.64
  • 20.190.159.2
whitelisted
ocsp.digicert.com
  • 192.229.221.95
whitelisted
slscr.update.microsoft.com
  • 20.12.23.50
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 13.85.23.206
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
WARZONE RAT 2.70 POISON - cortexnet.cc.zip.zip