bazaloader | 0f46cfd986c637d5494dda5c62a5392a31c9265a4022eff41f9b4b944ab3473e

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-01-2025 20:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_77c728151d3063d3278f4eb763275618.exe
Size

534KB
MD5

77c728151d3063d3278f4eb763275618
SHA1

ae067984fd809662bb1dfe40326e617bb3889bc0
SHA256

0f46cfd986c637d5494dda5c62a5392a31c9265a4022eff41f9b4b944ab3473e
SHA512

1ed6b7a7dd4db1bcab8e6f923bdeff507b4ae3dc0eae0b5fd27e46957cc2db32b44166c03ba87cd1221551ff52e4481a6b44e3932ee14d39e78b8df7dad9e289
SSDEEP

3072:FeLXZcICvc8rd8+597ofMVHVnudrNw4X5Vqn7VfiP2GLK/vMz8DNuC89NAa+zwJ4:F8GeWnvI8D47+1+1m5acfh5+CJK+

Score

10^/10

bazaloader warzonerat infostealer rat trojan

Malware Config

Signatures

Bazaloader family
bazaloader

Detects BazaLoader malware 1 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.

trojan

resource	yara_rule
behavioral1/memory/3040-2-0x0000000000590000-0x00000000006EE000-memory.dmp	BazaLoader

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/memory/3040-2-0x0000000000590000-0x00000000006EE000-memory.dmp	warzonerat

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 2704	3040	JaffaCakes118_77c728151d3063d3278f4eb763275618.exe	31
PID 3040 wrote to memory of 2704	3040	JaffaCakes118_77c728151d3063d3278f4eb763275618.exe	31
PID 3040 wrote to memory of 2704	3040	JaffaCakes118_77c728151d3063d3278f4eb763275618.exe	31

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77c728151d3063d3278f4eb763275618.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_77c728151d3063d3278f4eb763275618.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3040 -s 512
  2⤵
  PID:2704

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3040-0-0x000007FEF5EE3000-0x000007FEF5EE4000-memory.dmp

Filesize
4KB

Download
memory/3040-1-0x0000000000C90000-0x0000000000D1C000-memory.dmp

Filesize
560KB

Download
memory/3040-2-0x0000000000590000-0x00000000006EE000-memory.dmp

Filesize
1.4MB

Download