warzonerat | 1b9ddb40b3935d58544774f7c6b7e95343be5dc0a8bf98b3105163a5afbb8c65

General

Target

d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe
Size

566KB
MD5

d08dd66ae0730f1a09c753d34e1df3d5
SHA1

89bd1a89f887707bf85ce29a3ec4fd652333a8a6
SHA256

1b9ddb40b3935d58544774f7c6b7e95343be5dc0a8bf98b3105163a5afbb8c65
SHA512

ff14a6b9229be571421a22f963b5a644df9fdc85306d1dc2565c2fad603be8d1dfecf48e613c8ce1b6801486dd320d6c8584e8f85640b2d1e441820f09ee5d27
SSDEEP

12288:US4unwmcfDB/CyofvOnAYvy4I9Mm0l0MP2mo5hnyRIAT:T4uwhRCfvOnjy4I9Mm0HcnUT

Score

10^/10

warzonerat discovery infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

update.aquaholic.dev:84

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

resource	yara_rule
behavioral1/memory/2752-23-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2752-25-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2752-36-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2752-35-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2752-33-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2752-29-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2752-27-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2752-38-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Loads dropped DLL 1 IoCs

pid	Process
2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2104 set thread context of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2716	schtasks.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 2104 wrote to memory of 2716	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2716	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2716	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2716	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	31
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33
PID 2104 wrote to memory of 2752	2104	d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe	33

C:\Users\Admin\AppData\Local\Temp\d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iiwYjhWu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp8814.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\d08dd66ae0730f1a09c753d34e1df3d5_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\5c8eb483-eaaa-4d1c-b00f-96061051e8c4\AgileDotNetRT.dll

Filesize
94KB

MD5
14ff402962ad21b78ae0b4c43cd1f194

SHA1
f8a510eb26666e875a5bdd1cadad40602763ad72

SHA256
fb9646cb956945bdc503e69645f6b5316d3826b780d3c36738d6b944e884d15b

SHA512
daa7a08bf3709119a944bce28f6ebdd24e54a22b18cd9f86a87873e958df121a3881dcdd5e162f6b4e543238c7aef20f657c9830df01d4c79290f7c9a4fcc54b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp8814.tmp

Filesize
1KB

MD5
03e7b845eb6d46c50e20052be7eeff6f

SHA1
6a3756fcdd0d3cd52dde02e649ea5dd504032dd5

SHA256
74e93465e054eb6db17db543bc741fdbf8ac028da9581405e02b43bf5871b723

SHA512
1a55a74729d0dbb0f73e70d8085272c1c71efd2d875b280685efe6a3e33a5b50e03f2739764115a12450d9631178966db26b8e6b1710c9aef16a8ee59f6ed148

Download Submit
memory/2104-0-0x00000000744F1000-0x00000000744F2000-memory.dmp

Filesize
4KB

Download
memory/2104-1-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-3-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-9-0x0000000074370000-0x00000000743CB000-memory.dmp

Filesize
364KB

Download
memory/2104-10-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-11-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/2104-37-0x00000000744F0000-0x0000000074A9B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-25-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-23-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-36-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-35-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-33-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-31-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2752-29-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-27-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-21-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-17-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-19-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2752-38-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads