arrowrat | 87e904893a81c4ca7daa3fa4ddcb69527db3ad5d7c147dfd1dec6c5a333587f9

Analysis

max time kernel
31s
max time network
33s
platform
windows7_x64
resource
win7-20230621-en
resource tags

arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
submitted
30-06-2023 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
Size

457KB
MD5

288a04f04d9fc3e84ff5b2402c8050b1
SHA1

8e0b920bb33920e298ac9f73ab4b7ea0bbdfdbf2
SHA256

cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6
SHA512

928b111cfb151ad8967e1bde8e1e17ab592f0312f3883b1faf6578401b49cc741dde7ae426ee1ef7d8c985b3e4d4b287ccabaf01ea3841f8438d4dc993d9b5fb
SSDEEP

12288:QkoPbgRuF1R5u7w1eTe5XxLvZNOujzAKv546Q4dPHm:QkEb4E5u7w8Te5XxLhN9l54r4dHm

Score

10^/10

arrowrat client rat

Malware Config

Extracted

Family

arrowrat

Botnet

Client

212.224.86.109:1337

Mutex

mTiBFWwWe

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1940 set thread context of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1168	2012	WerFault.exe	32

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 1192	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	28
PID 1940 wrote to memory of 1192	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	28
PID 1940 wrote to memory of 1192	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	28
PID 1940 wrote to memory of 2036	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	29
PID 1940 wrote to memory of 2036	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	29
PID 1940 wrote to memory of 2036	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	29
PID 1940 wrote to memory of 1736	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	30
PID 1940 wrote to memory of 1736	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	30
PID 1940 wrote to memory of 1736	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	30
PID 1940 wrote to memory of 2008	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	31
PID 1940 wrote to memory of 2008	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	31
PID 1940 wrote to memory of 2008	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	31
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 1940 wrote to memory of 2012	1940	cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe	32
PID 2012 wrote to memory of 1168	2012	SetupUtility.exe	33
PID 2012 wrote to memory of 1168	2012	SetupUtility.exe	33
PID 2012 wrote to memory of 1168	2012	SetupUtility.exe	33
PID 2012 wrote to memory of 1168	2012	SetupUtility.exe	33

C:\Users\Admin\AppData\Local\Temp\cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
"C:\Users\Admin\AppData\Local\Temp\cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:1192
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"
  2⤵
  PID:2036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
  2⤵
  PID:1736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:2008
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2012
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 168
    3⤵
    - Program crash
    PID:1168

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1940-54-0x00000000003D0000-0x0000000000446000-memory.dmp

Filesize
472KB

Download
memory/1940-55-0x000000001BAF0000-0x000000001BB70000-memory.dmp

Filesize
512KB

Download
memory/2012-56-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download