arrowrat | 0caa17db0c1d695ce4e5bc3f3fc7c9c2e7f96e489108e0303b81fa45efcf92bd

General

Target

hvnc.exe
Size

138KB
MD5

bb434c347ca1709e54bee1a5d9a5757e
SHA1

844b1f01f53eb6e8f8934880fa7f8994c4245dd4
SHA256

0caa17db0c1d695ce4e5bc3f3fc7c9c2e7f96e489108e0303b81fa45efcf92bd
SHA512

46b87c83ce85d44b152a5921b76f65af19fc93896bc8557b979c72ffdbaef3b21245f1c8aea75a5bd2125bc8df7485f2bcaf98d8b7ee0785c8c1496d08a571be
SSDEEP

3072:PbvG5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yt:PbviS7BqjjYHdrqkL/

Score

10^/10

arrowrat krck1r persistence rat

Malware Config

Extracted

Family

arrowrat

Botnet

KRCK1R

C2

185.183.35.38:1338

Mutex

4IA671

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

hvnc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\DNL4G7\\URZSPD.exe"	hvnc.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

explorer.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Modifies registry class 5 IoCs

Processes:

explorer.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

Processes:

hvnc.exe

pid	process
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe
556	hvnc.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

Processes:

hvnc.exeexplorer.exeAUDIODG.EXE

description	pid	process
Token: SeDebugPrivilege	556	hvnc.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: 33	1940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1940	AUDIODG.EXE
Token: 33	1940	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1940	AUDIODG.EXE
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe
Token: SeShutdownPrivilege	1992	explorer.exe

Suspicious use of FindShellTrayWindow 24 IoCs

Processes:

explorer.exe

pid	process
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe

Suspicious use of SendNotifyMessage 16 IoCs

Processes:

explorer.exe

pid	process
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe
1992	explorer.exe

Suspicious use of WriteProcessMemory 46 IoCs

Processes:

hvnc.exeexplorer.exe

description	pid	process	target process
PID 556 wrote to memory of 1992	556	hvnc.exe	explorer.exe
PID 556 wrote to memory of 1992	556	hvnc.exe	explorer.exe
PID 556 wrote to memory of 1992	556	hvnc.exe	explorer.exe
PID 556 wrote to memory of 1836	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1836	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1836	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1836	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 804	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 804	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 804	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 804	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 908	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 908	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 908	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 908	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 900	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 900	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 900	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 900	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1644	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1644	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1644	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1644	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1600	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1600	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1600	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1600	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1720	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1720	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1720	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1720	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1528	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1528	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1528	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1528	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1556	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1556	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1556	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1556	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1652	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1652	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1652	556	hvnc.exe	cvtres.exe
PID 556 wrote to memory of 1652	556	hvnc.exe	cvtres.exe
PID 1992 wrote to memory of 1460	1992	explorer.exe	ctfmon.exe
PID 1992 wrote to memory of 1460	1992	explorer.exe	ctfmon.exe
PID 1992 wrote to memory of 1460	1992	explorer.exe	ctfmon.exe

C:\Users\Admin\AppData\Local\Temp\hvnc.exe
"C:\Users\Admin\AppData\Local\Temp\hvnc.exe"
1⤵
- Modifies WinLogon for persistence
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:556
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe"
  2⤵
  - Modifies Installed Components in the registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\system32\ctfmon.exe
    ctfmon.exe
    3⤵
    PID:1460
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:1836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:804
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:908
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:1528
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:1556
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:1652
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:1720
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:1600
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" KRCK1R 185.183.35.38 1338 4IA671
  2⤵
  PID:1644

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x550
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Winlogon Helper DLL

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/556-54-0x0000000000C70000-0x0000000000C98000-memory.dmp

Filesize
160KB

Download
memory/1460-57-0x0000000000000000-mapping.dmp

Download
memory/1992-55-0x0000000000000000-mapping.dmp

Download
memory/1992-56-0x000007FEFBCB1000-0x000007FEFBCB3000-memory.dmp

Filesize
8KB

Download
memory/1992-58-0x00000000026B0000-0x00000000026C0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads