Analysis
-
max time kernel
146s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05-03-2023 23:35
Behavioral task
behavioral1
Sample
bJ99.exe
Resource
win7-20230220-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
bJ99.exe
Resource
win10v2004-20230220-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
bJ99.exe
-
Size
138KB
-
MD5
2f73fdfb8140276968f2c1b358e5edf0
-
SHA1
160ec42cd31c98fdd91c8a837be32757b2b9af92
-
SHA256
5a45e4a32a4f2081b33dee2ab94eb3ebb4afafe0bd8f5b76e93dfe975c4a607c
-
SHA512
65c2ac40557d94cf715d720a3774547f10253fe00071cd6e1824f6304f02187e26184b7c064e8c5d0526bd8650e5854bae283cb080ea17ef3d007f28b0d477f3
-
SSDEEP
3072:+bvY5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/Yh:+bvwS7BqjjYHdrqkL/
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
OJG36C
C2
mayo21.duckdns.org:2158
Mutex
NT7WTE
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2647223082-2067913677-935928954-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe 1692 bJ99.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 1692 bJ99.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: 33 1356 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1356 AUDIODG.EXE Token: 33 1356 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1356 AUDIODG.EXE Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe Token: SeShutdownPrivilege 1944 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe 1944 explorer.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1692 wrote to memory of 1944 1692 bJ99.exe 28 PID 1692 wrote to memory of 1944 1692 bJ99.exe 28 PID 1692 wrote to memory of 1944 1692 bJ99.exe 28 PID 1692 wrote to memory of 1168 1692 bJ99.exe 29 PID 1692 wrote to memory of 1168 1692 bJ99.exe 29 PID 1692 wrote to memory of 1168 1692 bJ99.exe 29 PID 1692 wrote to memory of 1168 1692 bJ99.exe 29 PID 1692 wrote to memory of 592 1692 bJ99.exe 32 PID 1692 wrote to memory of 592 1692 bJ99.exe 32 PID 1692 wrote to memory of 592 1692 bJ99.exe 32 PID 1692 wrote to memory of 592 1692 bJ99.exe 32 PID 1944 wrote to memory of 572 1944 explorer.exe 30 PID 1944 wrote to memory of 572 1944 explorer.exe 30 PID 1944 wrote to memory of 572 1944 explorer.exe 30 PID 1692 wrote to memory of 580 1692 bJ99.exe 31 PID 1692 wrote to memory of 580 1692 bJ99.exe 31 PID 1692 wrote to memory of 580 1692 bJ99.exe 31 PID 1692 wrote to memory of 580 1692 bJ99.exe 31 PID 1692 wrote to memory of 696 1692 bJ99.exe 33 PID 1692 wrote to memory of 696 1692 bJ99.exe 33 PID 1692 wrote to memory of 696 1692 bJ99.exe 33 PID 1692 wrote to memory of 696 1692 bJ99.exe 33 PID 1692 wrote to memory of 1164 1692 bJ99.exe 34 PID 1692 wrote to memory of 1164 1692 bJ99.exe 34 PID 1692 wrote to memory of 1164 1692 bJ99.exe 34 PID 1692 wrote to memory of 1164 1692 bJ99.exe 34 PID 1692 wrote to memory of 1864 1692 bJ99.exe 35 PID 1692 wrote to memory of 1864 1692 bJ99.exe 35 PID 1692 wrote to memory of 1864 1692 bJ99.exe 35 PID 1692 wrote to memory of 1864 1692 bJ99.exe 35 PID 1692 wrote to memory of 268 1692 bJ99.exe 36 PID 1692 wrote to memory of 268 1692 bJ99.exe 36 PID 1692 wrote to memory of 268 1692 bJ99.exe 36 PID 1692 wrote to memory of 268 1692 bJ99.exe 36 PID 1692 wrote to memory of 1920 1692 bJ99.exe 37 PID 1692 wrote to memory of 1920 1692 bJ99.exe 37 PID 1692 wrote to memory of 1920 1692 bJ99.exe 37 PID 1692 wrote to memory of 1920 1692 bJ99.exe 37 PID 1692 wrote to memory of 1672 1692 bJ99.exe 38 PID 1692 wrote to memory of 1672 1692 bJ99.exe 38 PID 1692 wrote to memory of 1672 1692 bJ99.exe 38 PID 1692 wrote to memory of 1672 1692 bJ99.exe 38 PID 1692 wrote to memory of 1332 1692 bJ99.exe 39 PID 1692 wrote to memory of 1332 1692 bJ99.exe 39 PID 1692 wrote to memory of 1332 1692 bJ99.exe 39 PID 1692 wrote to memory of 1332 1692 bJ99.exe 39 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\bJ99.exe"C:\Users\Admin\AppData\Local\Temp\bJ99.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1692 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:572
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:1168
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:580
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:592
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:696
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:1164
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:1864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:268
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:1920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:1672
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" OJG36C mayo21.duckdns.org 2158 NT7WTE2⤵PID:1332
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x51c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1356