warzonerat | 917867fc54684f79293c924a822066f9d4153ff9dd48fee20af264c6ba747583

General

Target

083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
Size

345KB
MD5

083e2d9602153bb49f5b0aa4478d8649
SHA1

0f148128eacc1dbcc92a768ab4caea17572b29c7
SHA256

917867fc54684f79293c924a822066f9d4153ff9dd48fee20af264c6ba747583
SHA512

4c47d8a9ec38ccee76d760ebdfc66d8001794da14d758b4f13832d60637c2e11ca6c9280c9431ad39d93d79855b81eb1611ea78e97af9b518134c5802bb214b9
SSDEEP

3072:neEcebtEZN2DdfEzbbk7VRn4OOiWXYXCSioCqpkUzAgMWCiFWeETnPKr3UK8gYfk:czb0VciWoXiTziGTnPKDRKyZaIDcU

Score

10^/10

warzonerat infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

warzon957.duckdns.org:4546

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/2696-17-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2696-20-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2696-19-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2696-14-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2696-13-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2696-12-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2696-11-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral1/memory/2696-22-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Drops startup file 2 IoCs

Processes:

083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

description	pid	process	target process
PID 2764 set thread context of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

Processes:

083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

pid	process
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 2764 083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

description	pid	process	target process
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
PID 2764 wrote to memory of 2696	2764	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe	083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764

C:\Users\Admin\AppData\Local\Temp\083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\083e2d9602153bb49f5b0aa4478d8649_JaffaCakes118.exe"
2⤵
PID:2696

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2696-14-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-22-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-11-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-9-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-10-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-12-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-13-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-8-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-17-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-20-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-19-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/2696-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2764-5-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/2764-7-0x00000000004E0000-0x00000000004E1000-memory.dmp

Filesize
4KB

Download
memory/2764-0-0x0000000000220000-0x000000000027C000-memory.dmp

Filesize
368KB

Download
memory/2764-21-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-4-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download
memory/2764-3-0x0000000004B60000-0x0000000004BA0000-memory.dmp

Filesize
256KB

Download
memory/2764-2-0x0000000000430000-0x0000000000478000-memory.dmp

Filesize
288KB

Download
memory/2764-1-0x00000000748A0000-0x0000000074F8E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads