arrowrat | 100dc0db633b1dea1a0c5012f2364ff0d201ff203de1ea3820f432fc51751652

Resubmissions

27-07-2024 01:26

240727-btjhqs1bqc 3

21-02-2023 10:55

230221-m1mdragd5y 1

21-02-2023 10:48

230221-mwehcaee59 10

Analysis

max time kernel
234s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
21-02-2023 10:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

PandorahVNC.exe
Size

121.7MB
MD5

7e0c8dba7497c6c4239531073a04628e
SHA1

d82c10b1ed2527f971b2c63e75c15a6b746119b0
SHA256

100dc0db633b1dea1a0c5012f2364ff0d201ff203de1ea3820f432fc51751652
SHA512

e8e79732885f4f38c15fe1e78e740b0678de64c5b8875f590678eca8229190ab84be04724f934037a8837238431c1c0b5809eebdc5e0ee8eb610be012996b722
SSDEEP

3145728:Rlhah9cOLbrHMevdE5x89uYrM0cqgW05zaWPP:p09cOnrBdE5x50ce0

Score

10^/10

arrowrat client rat

Malware Config

Extracted

Family

arrowrat

Botnet

Client

10.127.0.177:1337

Mutex

dDfknvgAH

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat
Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	PandorahVNC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 35 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 50003100000000005456a7b1100041646d696e003c0009000400efbe5456d2a655563d5e2e0000008de10100000001000000000000000000000000000000ad807a00410064006d0069006e00000014000000	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0 = 5000310000000000545679aa10004c6f63616c003c0009000400efbe5456d2a655563d5e2e000000abe10100000001000000000000000000000000000000234427014c006f00630061006c00000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0 = 4e003100000000005556775e100054656d7000003a0009000400efbe5456d2a655567a5e2e000000ace1010000000100000000000000000000000000000062356900540065006d007000000014000000	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 56003100000000005456d2a612004170704461746100400009000400efbe5456d2a655563d5e2e00000098e10100000001000000000000000000000000000000798120004100700070004400610074006100000016000000	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\NodeSlot = "1"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 19002f433a5c000000000000000000000000000000000000000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 78003100000000005456d2a61100557365727300640009000400efbe874f774855563d5e2e000000c70500000000010000000000000000003a00000000002244440055007300650072007300000040007300680065006c006c00330032002e0064006c006c002c002d0032003100380031003300000014000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Generic"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\0\0	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3824	explorer.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
4932	PandorahVNC.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4932	PandorahVNC.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4932	PandorahVNC.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe
4932	PandorahVNC.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4932	PandorahVNC.exe
4932	PandorahVNC.exe
3824	explorer.exe
3824	explorer.exe
3824	explorer.exe
3824	explorer.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2976	4932	PandorahVNC.exe	81
PID 4932 wrote to memory of 2976	4932	PandorahVNC.exe	81
PID 4932 wrote to memory of 2976	4932	PandorahVNC.exe	81

C:\Users\Admin\AppData\Local\Temp\PandorahVNC.exe
"C:\Users\Admin\AppData\Local\Temp\PandorahVNC.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\System32\explorer.exe" C:\Users\Admin\AppData\Local\Temp
  2⤵
  PID:2976

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3824

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2464

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
ee6fe9d2eec3e7c24e47a243b6ef0bd8

SHA1
9f4da1d3fb08fe871bad36bdfcb88f01d8e3daaf

SHA256
274b12d01a916d7c10beca3448f443868624cf121b5e68a7340fe4c280aa2420

SHA512
66f84b8c75c094e1f40790614f7a50241bbe0c4bc9d58dfc6248f846cc902fa6fa1813512b195f62a3fdd8a1c60933a8317ebc90df79357b11605d1580087838

Download Submit
C:\Users\Admin\AppData\Local\Temp\Client.exe

Filesize
157KB

MD5
4d764fab01ffda078259455f763562d9

SHA1
c5907abdff385d62df8d37a21158c4b4bb485014

SHA256
98f1b39676315d8f6797305d49444be82ccc2c935007dd97b20282cb804d3b6a

SHA512
c38b30a615d20f7d5c2220b8dd45e608b55a89ee4d40f5a32e16c2ea376c2b6c767d1c660f388b8f985eaab020fdeeae1a2bb18474dc32ee31870c2d6899b67a

Download Submit
memory/4932-141-0x000000001AA40000-0x000000001AA78000-memory.dmp

Filesize
224KB

Download
memory/4932-144-0x000000000EEA0000-0x000000000EEC0000-memory.dmp

Filesize
128KB

Download
memory/4932-137-0x0000000013BF0000-0x0000000013C82000-memory.dmp

Filesize
584KB

Download
memory/4932-138-0x0000000014F70000-0x0000000014FAC000-memory.dmp

Filesize
240KB

Download
memory/4932-139-0x0000000016E00000-0x0000000016E0A000-memory.dmp

Filesize
40KB

Download
memory/4932-140-0x000000001A890000-0x000000001A8BE000-memory.dmp

Filesize
184KB

Download
memory/4932-133-0x0000000000A80000-0x0000000001A80000-memory.dmp

Filesize
16.0MB

Download
memory/4932-142-0x000000000A950000-0x000000000A960000-memory.dmp

Filesize
64KB

Download
memory/4932-143-0x000000000A950000-0x000000000A960000-memory.dmp

Filesize
64KB

Download
memory/4932-136-0x000000000A950000-0x000000000A960000-memory.dmp

Filesize
64KB

Download
memory/4932-145-0x000000000A950000-0x000000000A960000-memory.dmp

Filesize
64KB

Download
memory/4932-146-0x0000000011160000-0x000000001120A000-memory.dmp

Filesize
680KB

Download
memory/4932-147-0x000000000F9C0000-0x000000000FA5C000-memory.dmp

Filesize
624KB

Download
memory/4932-148-0x000000000A950000-0x000000000A960000-memory.dmp

Filesize
64KB

Download
memory/4932-149-0x000000000A950000-0x000000000A960000-memory.dmp

Filesize
64KB

Download
memory/4932-135-0x000000000D480000-0x000000000DA24000-memory.dmp

Filesize
5.6MB

Download
memory/4932-134-0x000000000A8E0000-0x000000000A8F2000-memory.dmp

Filesize
72KB

Download