warzonerat | 19208770999143f57876f067c6b8d4e6095c54f325b7ff7a0876972dd9239a07

General

Target

f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe
Size

454KB
MD5

f44c5ee427e17ec6ca2cca529dac4960
SHA1

057f34c7f586cb3ad5c6ac5bac85e10dc1b7c1a3
SHA256

19208770999143f57876f067c6b8d4e6095c54f325b7ff7a0876972dd9239a07
SHA512

5e383990ff8f970b6b7d0f7ff6d61df6135a26730d36b8498d9b13bf2f489d303db63d15c7e6049b0da5538cf62f373c0af6d27f05257da1e466a9c878fe4dfd
SSDEEP

12288:p5BbwrSx/ZzLXbtsnNCAoVR/cPIVmXh0H7:p5Bbwrk/ZzLLtsnN6Wu

Score

10^/10

warzonerat discovery infostealer persistence rat

Malware Config

Extracted

Family

warzonerat

C2

samirsana2019.myftp.biz:5200

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "\"C:\\Users\\Admin\\AppData\\Roaming\\jPjS4L0aQ3b04ux5\\JDG07sPXHlvO.exe\",explorer.exe"	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 8 IoCs

rat

resource	yara_rule
behavioral1/memory/2816-18-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2816-15-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2816-14-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2816-13-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2816-12-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2816-20-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2816-21-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat
behavioral1/memory/2816-23-0x0000000000400000-0x000000000041D000-memory.dmp	warzonerat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2640 set thread context of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe
2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31
PID 2640 wrote to memory of 2816	2640	f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe	31

C:\Users\Admin\AppData\Local\Temp\f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\f44c5ee427e17ec6ca2cca529dac4960_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2640-0-0x00000000745D1000-0x00000000745D2000-memory.dmp

Filesize
4KB

Download
memory/2640-1-0x00000000745D0000-0x0000000074B7B000-memory.dmp

Filesize
5.7MB

Download
memory/2640-2-0x00000000745D0000-0x0000000074B7B000-memory.dmp

Filesize
5.7MB

Download
memory/2640-3-0x00000000745D0000-0x0000000074B7B000-memory.dmp

Filesize
5.7MB

Download
memory/2640-4-0x00000000745D0000-0x0000000074B7B000-memory.dmp

Filesize
5.7MB

Download
memory/2640-22-0x00000000745D0000-0x0000000074B7B000-memory.dmp

Filesize
5.7MB

Download
memory/2816-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2816-18-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-9-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-15-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-14-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-13-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-12-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-11-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-20-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-21-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-7-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/2816-23-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads