warzonerat | 1b4347b37824a5228980b97f689240fa7f099fd6cab09878456b31673fb36acd

General

Target

3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
Size

897KB
MD5

3c2b4c82ab548b752297e6cb250ac114
SHA1

370119ea96855a6934d020f3944f019890135677
SHA256

1b4347b37824a5228980b97f689240fa7f099fd6cab09878456b31673fb36acd
SHA512

5437fde02711fea91e6ada1689bf95ad6108e585b65744354a08b5206aeafefdf1721c6f144f70dc776b3c04aba487746accb865f61079fc958dd0fddb53ec20
SSDEEP

12288:vH4cZKRn3qGaNHEyC9/oR9gy5FHK7zcvjt73J8IZnarJmgoXaYfsxYRuiNr+MrgO:vPZKJPp9AR95y2tZhnim2packLl

Score

10^/10

warzonerat discovery infostealer rat

Malware Config

Extracted

Family

warzonerat

C2

185.222.57.73:4557

Signatures

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat

Warzone RAT payload 4 IoCs

rat

resource	yara_rule
behavioral2/memory/3624-18-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3624-20-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3624-22-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat
behavioral2/memory/3624-24-0x0000000000400000-0x0000000000554000-memory.dmp	warzonerat

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 468 set thread context of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 4948	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	90
PID 468 wrote to memory of 4948	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	90
PID 468 wrote to memory of 4948	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	90
PID 468 wrote to memory of 3680	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	92
PID 468 wrote to memory of 3680	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	92
PID 468 wrote to memory of 3680	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	92
PID 468 wrote to memory of 3032	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	93
PID 468 wrote to memory of 3032	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	93
PID 468 wrote to memory of 3032	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	93
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94
PID 468 wrote to memory of 3624	468	3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe	94

C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:468
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\JbNFDCKK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp505D.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:4948
- C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe"
  2⤵
  PID:3680
- C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe"
  2⤵
  PID:3032
- C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe
  "C:\Users\Admin\AppData\Local\Temp\3c2b4c82ab548b752297e6cb250ac114_JaffaCakes118.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp505D.tmp

Filesize
1KB

MD5
102e46cb46e84a5123218d853c3989bd

SHA1
ac971d3145388a8c2a7526fc3b729b1e2a1175c4

SHA256
54757c4e91532be671db7dc410ce3e7c856b5132c5a0ed8aadb52a6fb1e2de14

SHA512
f93a09088517305cb816b48381be7e0606471518cb7c44561c4d9369f4ce6fa7853c8fba4bb3fdc0dc98bf4ad3a2c38a63a1300fb7b2dede9b541363e7912f1a

Download Submit
memory/468-8-0x0000000006010000-0x0000000006026000-memory.dmp

Filesize
88KB

Download
memory/468-3-0x00000000052B0000-0x0000000005854000-memory.dmp

Filesize
5.6MB

Download
memory/468-10-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/468-11-0x0000000007A30000-0x0000000007AC2000-memory.dmp

Filesize
584KB

Download
memory/468-5-0x0000000004C30000-0x0000000004C3A000-memory.dmp

Filesize
40KB

Download
memory/468-6-0x0000000004F30000-0x0000000004F86000-memory.dmp

Filesize
344KB

Download
memory/468-7-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/468-0-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/468-9-0x0000000074B4E000-0x0000000074B4F000-memory.dmp

Filesize
4KB

Download
memory/468-2-0x0000000004C60000-0x0000000004CFC000-memory.dmp

Filesize
624KB

Download
memory/468-4-0x0000000004D00000-0x0000000004D92000-memory.dmp

Filesize
584KB

Download
memory/468-12-0x000000000A1A0000-0x000000000A1C2000-memory.dmp

Filesize
136KB

Download
memory/468-1-0x0000000000180000-0x0000000000266000-memory.dmp

Filesize
920KB

Download
memory/468-23-0x0000000074B40000-0x00000000752F0000-memory.dmp

Filesize
7.7MB

Download
memory/3624-20-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3624-22-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3624-18-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download
memory/3624-24-0x0000000000400000-0x0000000000554000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads