Analysis
-
max time kernel
138s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
10-01-2025 06:30
Static task
static1
Behavioral task
behavioral1
Sample
RFQ 8976765564566787978754566787909875654567.scr
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
RFQ 8976765564566787978754566787909875654567.scr
Resource
win10v2004-20241007-en
General
-
Target
RFQ 8976765564566787978754566787909875654567.scr
-
Size
557KB
-
MD5
f302ac3931ec4406589e92bb0ceb5a05
-
SHA1
e9fc3f3264cd3a1ec6023493a5c96c2ba317755f
-
SHA256
6b83778b6931df0a74268e44daf5ca87dee79b0360b1022e6976281c5a1c58de
-
SHA512
a3ce33d824ccd13a368e974d0df5d33081474652223280fd8464339f59a2598d80b8c83490b543a3d2cb09af60d4a342fe918fdb72076dafe4fdfe954817922c
-
SSDEEP
12288:8zll9Z7a0GM4Rb9So1JELBYaKMwHI3lpa+zD56gsjFQX0zHVjczn4SB0AjlEVwtw:qawL6Ib/N6zjFQERQn4SB1jRti
Malware Config
Extracted
warzonerat
172.245.23.149:4020
Signatures
-
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 10 IoCs
resource yara_rule behavioral1/memory/2628-33-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-30-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-28-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-26-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-24-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-35-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-41-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-43-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-48-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat behavioral1/memory/2628-49-0x0000000000400000-0x000000000041D000-memory.dmp warzonerat -
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2440 powershell.exe 2132 powershell.exe -
Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\TermService\Parameters\ServiceDll = "%ProgramFiles%\\Microsoft DN1\\sqlmap.dll" RFQ 8976765564566787978754566787909875654567.scr -
Loads dropped DLL 2 IoCs
pid Process 1540 Process not Found 864 Process not Found -
Modifies WinLogon 2 TTPs 5 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\ypwBGuF = "0" RFQ 8976765564566787978754566787909875654567.scr Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\gJk.ozA = "0" RFQ 8976765564566787978754566787909875654567.scr Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\AllowMultipleTSSessions = "1" RFQ 8976765564566787978754566787909875654567.scr Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList RFQ 8976765564566787978754566787909875654567.scr Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts RFQ 8976765564566787978754566787909875654567.scr -
Hide Artifacts: Hidden Users 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\ypwBGuF = "0" RFQ 8976765564566787978754566787909875654567.scr Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList\gJk.ozA = "0" RFQ 8976765564566787978754566787909875654567.scr -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1872 set thread context of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\Microsoft DN1\sqlmap.dll RFQ 8976765564566787978754566787909875654567.scr File opened for modification C:\Program Files\Microsoft DN1\sqlmap.dll RFQ 8976765564566787978754566787909875654567.scr File created C:\Program Files\Microsoft DN1\rdpwrap.ini RFQ 8976765564566787978754566787909875654567.scr -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ 8976765564566787978754566787909875654567.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RFQ 8976765564566787978754566787909875654567.scr Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2796 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2440 powershell.exe 2132 powershell.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 864 Process not Found -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2440 powershell.exe Token: SeDebugPrivilege 2132 powershell.exe Token: SeDebugPrivilege 2628 RFQ 8976765564566787978754566787909875654567.scr Token: SeDebugPrivilege 2628 RFQ 8976765564566787978754566787909875654567.scr -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 1872 wrote to memory of 2440 1872 RFQ 8976765564566787978754566787909875654567.scr 31 PID 1872 wrote to memory of 2440 1872 RFQ 8976765564566787978754566787909875654567.scr 31 PID 1872 wrote to memory of 2440 1872 RFQ 8976765564566787978754566787909875654567.scr 31 PID 1872 wrote to memory of 2440 1872 RFQ 8976765564566787978754566787909875654567.scr 31 PID 1872 wrote to memory of 2132 1872 RFQ 8976765564566787978754566787909875654567.scr 33 PID 1872 wrote to memory of 2132 1872 RFQ 8976765564566787978754566787909875654567.scr 33 PID 1872 wrote to memory of 2132 1872 RFQ 8976765564566787978754566787909875654567.scr 33 PID 1872 wrote to memory of 2132 1872 RFQ 8976765564566787978754566787909875654567.scr 33 PID 1872 wrote to memory of 2796 1872 RFQ 8976765564566787978754566787909875654567.scr 35 PID 1872 wrote to memory of 2796 1872 RFQ 8976765564566787978754566787909875654567.scr 35 PID 1872 wrote to memory of 2796 1872 RFQ 8976765564566787978754566787909875654567.scr 35 PID 1872 wrote to memory of 2796 1872 RFQ 8976765564566787978754566787909875654567.scr 35 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 1872 wrote to memory of 2628 1872 RFQ 8976765564566787978754566787909875654567.scr 37 PID 2628 wrote to memory of 2644 2628 RFQ 8976765564566787978754566787909875654567.scr 38 PID 2628 wrote to memory of 2644 2628 RFQ 8976765564566787978754566787909875654567.scr 38 PID 2628 wrote to memory of 2644 2628 RFQ 8976765564566787978754566787909875654567.scr 38 PID 2628 wrote to memory of 2644 2628 RFQ 8976765564566787978754566787909875654567.scr 38 PID 2628 wrote to memory of 2644 2628 RFQ 8976765564566787978754566787909875654567.scr 38 PID 2628 wrote to memory of 2644 2628 RFQ 8976765564566787978754566787909875654567.scr 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ 8976765564566787978754566787909875654567.scr"C:\Users\Admin\AppData\Local\Temp\RFQ 8976765564566787978754566787909875654567.scr" /S1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1872 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\RFQ 8976765564566787978754566787909875654567.scr"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\rQCIRoFZewxkov.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2132
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\rQCIRoFZewxkov" /XML "C:\Users\Admin\AppData\Local\Temp\tmp261.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2796
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ 8976765564566787978754566787909875654567.scr"C:\Users\Admin\AppData\Local\Temp\RFQ 8976765564566787978754566787909875654567.scr"2⤵
- Server Software Component: Terminal Services DLL
- Modifies WinLogon
- Hide Artifacts: Hidden Users
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2644
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Server Software Component
1Terminal Services DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Winlogon Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD582466f69c4abb0b9facf8e5dbed8de20
SHA192f137653b5bd9622031cc57dc69af03f7c6bf20
SHA256ccb48b5e85139c558604aacf59761c569bd3a2bcfe80095d9870a5d4b4ac5343
SHA5125b7f99875d2ddb2d5c3d9e6ee3ebc23baffed01dfa7a245663f4661bd075cd509c21a24730ee1d899d91a5db61d7b7f36dba28f2a70d4ffdc3ec07007565ae86
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5fc0abb315829568b7af5b72c6384725e
SHA1ca218e5e8698e9825abeaa68efa8ef53cc5d65cf
SHA256164c76e1fce97468a765a6f39153e85e8ca0ef45bb041c408960b34092934141
SHA512b0a44962b07d6f2cfccb0c79f17d097273d69ab3e6828a36af51b6c0d9c30fb2f97dffa2961481781273c2adbf689708ef7276f3bbda34d14033022301dc8c29
-
Filesize
114KB
MD5461ade40b800ae80a40985594e1ac236
SHA1b3892eef846c044a2b0785d54a432b3e93a968c8
SHA256798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
SHA512421f9060c4b61fa6f4074508602a2639209032fd5df5bfc702a159e3bad5479684ccb3f6e02f3e38fb8db53839cf3f41fe58a3acad6ec1199a48dc333b2d8a26