Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
30-06-2023 11:42
Static task
static1
Behavioral task
behavioral1
Sample
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
Resource
win10v2004-20230621-en
General
-
Target
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe
-
Size
457KB
-
MD5
288a04f04d9fc3e84ff5b2402c8050b1
-
SHA1
8e0b920bb33920e298ac9f73ab4b7ea0bbdfdbf2
-
SHA256
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6
-
SHA512
928b111cfb151ad8967e1bde8e1e17ab592f0312f3883b1faf6578401b49cc741dde7ae426ee1ef7d8c985b3e4d4b287ccabaf01ea3841f8438d4dc993d9b5fb
-
SSDEEP
12288:QkoPbgRuF1R5u7w1eTe5XxLvZNOujzAKv546Q4dPHm:QkEb4E5u7w8Te5XxLhN9l54r4dHm
Malware Config
Extracted
arrowrat
Client
212.224.86.109:1337
mTiBFWwWe
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exedescription pid process target process PID 1940 set thread context of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1168 2012 WerFault.exe SetupUtility.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exepid process 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exedescription pid process Token: SeDebugPrivilege 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exeSetupUtility.exedescription pid process target process PID 1940 wrote to memory of 1192 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe dfsvc.exe PID 1940 wrote to memory of 1192 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe dfsvc.exe PID 1940 wrote to memory of 1192 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe dfsvc.exe PID 1940 wrote to memory of 2036 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe regtlibv12.exe PID 1940 wrote to memory of 2036 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe regtlibv12.exe PID 1940 wrote to memory of 2036 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe regtlibv12.exe PID 1940 wrote to memory of 1736 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe aspnet_regsql.exe PID 1940 wrote to memory of 1736 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe aspnet_regsql.exe PID 1940 wrote to memory of 1736 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe aspnet_regsql.exe PID 1940 wrote to memory of 2008 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe aspnet_regbrowsers.exe PID 1940 wrote to memory of 2008 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe aspnet_regbrowsers.exe PID 1940 wrote to memory of 2008 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe aspnet_regbrowsers.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 1940 wrote to memory of 2012 1940 cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe SetupUtility.exe PID 2012 wrote to memory of 1168 2012 SetupUtility.exe WerFault.exe PID 2012 wrote to memory of 1168 2012 SetupUtility.exe WerFault.exe PID 2012 wrote to memory of 1168 2012 SetupUtility.exe WerFault.exe PID 2012 wrote to memory of 1168 2012 SetupUtility.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe"C:\Users\Admin\AppData\Local\Temp\cd15fbc9e839dbc2888b3e72c47827e09a8bc50038a509f138c266ebcf2f3ed6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵PID:1192
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regtlibv12.exe"2⤵PID:2036
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"2⤵PID:1736
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"2⤵PID:2008
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\SetupUtility.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2012 -s 1683⤵
- Program crash
PID:1168