bazaloader | 7272fdc3facbd587946b1fd31d836dfd4ec5bbeb4b157d93c70611e854c70c89

Resubmissions

20/07/2025, 17:12

250720-vq696sen6w3

20/07/2025, 17:11

250720-vqly8ssls7

20/07/2025, 16:57

250720-vgbf5sel8110

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20250619-en
resource tags

arch:x64arch:x86image:win10v2004-20250619-enlocale:en-usos:windows10-2004-x64system
submitted
20/07/2025, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
Size 865KB
Sample250720-vgbf5sel81
SHA256 7272fdc3facbd587946b1fd31d836dfd4ec5bbeb4b157d93c70611e854c70c89
MD5 234845cfbdd1def148bc0e57904df499
SHA1 29c961d3308bb72b8f91de034a7c5500a6e1a034
SHA512 0036370c24f916161b2dfd3e98d9ecefb8d23371728e664fd3ceffcddac52df53b4274e73411371dd467b5cbff09ba7642243a375c58b99188d3167c256386f7
SSDEEP 6144:wUmWk+SWrtbcjZ2hahc21yPpWmulhR3QYHqOUga/yh3lZvIzii6qXCS20WSLl9fl:3mdetbaZ6ahc/nWhR3ndzh3olv1jDl
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

bazaloader warzonerat discovery infostealer rat trojan

Malware Config

Extracted

Family

warzonerat

sdafsdffssffs.ydns.eu:6703

Signatures

Bazaloader family
bazaloader

Detects BazaLoader malware 5 IoCs

BazaLoader is a trojan that transmits logs to the Command and Control (C2) server, encoding them in BASE64 format through GET requests - JaffaCakes118.

trojan

resource	yara_rule
behavioral1/memory/4420-11-0x0000000000400000-0x000000000055E000-memory.dmp	BazaLoader
behavioral1/memory/4420-14-0x0000000000400000-0x000000000055E000-memory.dmp	BazaLoader
behavioral1/memory/4420-15-0x0000000000400000-0x000000000055E000-memory.dmp	BazaLoader
behavioral1/memory/4420-20-0x0000000000400000-0x000000000055E000-memory.dmp	BazaLoader
behavioral1/memory/5008-26-0x0000000000400000-0x000000000055E000-memory.dmp	BazaLoader

WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
rat infostealer warzonerat
Warzonerat family
warzonerat

Warzone RAT payload 5 IoCs

rat

resource	yara_rule
behavioral1/memory/4420-11-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/4420-14-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/4420-15-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/4420-20-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat
behavioral1/memory/5008-26-0x0000000000400000-0x000000000055E000-memory.dmp	warzonerat

Executes dropped EXE 2 IoCs

pid	Process
4872	images.exe
5008	images.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2548 set thread context of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 4872 set thread context of 5008	4872	images.exe	105

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	images.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	images.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 5912	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	96
PID 2548 wrote to memory of 5912	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	96
PID 2548 wrote to memory of 5912	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	96
PID 2548 wrote to memory of 3192	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	97
PID 2548 wrote to memory of 3192	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	97
PID 2548 wrote to memory of 3192	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	97
PID 2548 wrote to memory of 1908	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	98
PID 2548 wrote to memory of 1908	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	98
PID 2548 wrote to memory of 1908	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	98
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 2548 wrote to memory of 4420	2548	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	99
PID 4420 wrote to memory of 4860	4420	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	101
PID 4420 wrote to memory of 4860	4420	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	101
PID 4420 wrote to memory of 4860	4420	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	101
PID 4420 wrote to memory of 4872	4420	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	102
PID 4420 wrote to memory of 4872	4420	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	102
PID 4420 wrote to memory of 4872	4420	JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe	102
PID 4860 wrote to memory of 4800	4860	cmd.exe	104
PID 4860 wrote to memory of 4800	4860	cmd.exe	104
PID 4860 wrote to memory of 4800	4860	cmd.exe	104
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 4872 wrote to memory of 5008	4872	images.exe	105
PID 5008 wrote to memory of 5704	5008	images.exe	106
PID 5008 wrote to memory of 5704	5008	images.exe	106
PID 5008 wrote to memory of 5704	5008	images.exe	106
PID 5008 wrote to memory of 5704	5008	images.exe	106
PID 5008 wrote to memory of 5704	5008	images.exe	106

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
  "{path}"
  2⤵
  PID:5912
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
  "{path}"
  2⤵
  PID:3192
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
  "{path}"
  2⤵
  PID:1908
- C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_234845cfbdd1def148bc0e57904df499.exe
  "{path}"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /f /v Load /t REG_SZ /d "C:\ProgramData\images.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4800
- - C:\ProgramData\images.exe
    "C:\ProgramData\images.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4872
  - - C:\ProgramData\images.exe
      "{path}"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5008
    - - C:\Windows\SysWOW64\cmd.exe
        
        "C:\Windows\System32\cmd.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

images.exe

Path C:\ProgramData\images.exe
Size 865KB
SHA256 7272fdc3facbd587946b1fd31d836dfd4ec5bbeb4b157d93c70611e854c70c89
MD5 234845cfbdd1def148bc0e57904df499
SHA1 29c961d3308bb72b8f91de034a7c5500a6e1a034
SHA512 0036370c24f916161b2dfd3e98d9ecefb8d23371728e664fd3ceffcddac52df53b4274e73411371dd467b5cbff09ba7642243a375c58b99188d3167c256386f7
SSDEEP 6144:wUmWk+SWrtbcjZ2hahc21yPpWmulhR3QYHqOUga/yh3lZvIzii6qXCS20WSLl9fl:3mdetbaZ6ahc/nWhR3ndzh3olv1jDl
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2548-10-0x0000000006860000-0x000000000688C000-memory.dmp

Download

memory/2548-1-0x0000000005350000-0x00000000053EC000-memory.dmp

Download

memory/2548-3-0x0000000005520000-0x00000000055B2000-memory.dmp

Download

memory/2548-0-0x0000000000930000-0x0000000000A0E000-memory.dmp

Download

memory/2548-5-0x0000000005440000-0x000000000544A000-memory.dmp

Download

memory/2548-6-0x00000000056C0000-0x0000000005716000-memory.dmp

Download

memory/2548-7-0x0000000002C80000-0x0000000002C94000-memory.dmp

Download

memory/2548-8-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/2548-2-0x0000000005A30000-0x0000000005FD4000-memory.dmp

Download

memory/2548-9-0x00000000067E0000-0x000000000685C000-memory.dmp

Download

memory/2548-4-0x00000000056B0000-0x00000000056C0000-memory.dmp

Download

memory/4420-14-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4420-15-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4420-11-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4420-20-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/4872-21-0x0000000004F00000-0x0000000004F10000-memory.dmp

Download

memory/4872-22-0x0000000004F00000-0x0000000004F10000-memory.dmp

Download

memory/5008-26-0x0000000000400000-0x000000000055E000-memory.dmp

Download

memory/5704-27-0x0000000000D30000-0x0000000000D31000-memory.dmp

Download