Analysis
-
max time kernel
1799s -
max time network
1806s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
18-07-2023 10:52
Behavioral task
behavioral1
Sample
ClientH.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ClientH.exe
Resource
win10v2004-20230703-en
General
-
Target
ClientH.exe
-
Size
90KB
-
MD5
5ac5cf4a09a5c6dfd82669a0e24f675d
-
SHA1
4f0993bfd2245da594000bb7c2d2bd7d02b60d53
-
SHA256
6136b0b9b28b52962f090cdf34ac650c4b184f3a65e863e2051cdc1219aff051
-
SHA512
e0317cf9a5a495f5e90a88f4a96517626a30c016b7374db41bc79a8bcb0920fcf7691ca3cf48c712b8bc2db075d734ca7cacc771e8f604297600187afe314d3f
-
SSDEEP
1536:dbRiQMB57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33a:dbRO57SKsstcnZTJQDgWPaySsdH5K
Malware Config
Extracted
arrowrat
VenomHVNC
wasted9sss1-57562.portmap.host:57562
uSzDNutNI.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ClientH.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\LbJIPffl\\LbJIPffl" ClientH.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ClientH.exedescription pid process target process PID 1924 set thread context of 2652 1924 ClientH.exe cvtres.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1024678951-1535676557-2778719785-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Runs .reg file with regedit 1 IoCs
Processes:
regedit.exepid process 2028 regedit.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
vlc.exepid process 3016 vlc.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ClientH.exepid process 1924 ClientH.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
vlc.exepid process 3016 vlc.exe -
Suspicious use of AdjustPrivilegeToken 20 IoCs
Processes:
ClientH.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1924 ClientH.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe Token: SeShutdownPrivilege 1080 explorer.exe -
Suspicious use of FindShellTrayWindow 39 IoCs
Processes:
explorer.exevlc.exepid process 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe -
Suspicious use of SendNotifyMessage 28 IoCs
Processes:
explorer.exevlc.exepid process 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 3016 vlc.exe 1080 explorer.exe 1080 explorer.exe 1080 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
vlc.exepid process 3016 vlc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ClientH.exeexplorer.exedescription pid process target process PID 1924 wrote to memory of 1080 1924 ClientH.exe explorer.exe PID 1924 wrote to memory of 1080 1924 ClientH.exe explorer.exe PID 1924 wrote to memory of 1080 1924 ClientH.exe explorer.exe PID 1924 wrote to memory of 1080 1924 ClientH.exe explorer.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1924 wrote to memory of 2652 1924 ClientH.exe cvtres.exe PID 1080 wrote to memory of 2932 1080 explorer.exe ctfmon.exe PID 1080 wrote to memory of 2932 1080 explorer.exe ctfmon.exe PID 1080 wrote to memory of 2932 1080 explorer.exe ctfmon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClientH.exe"C:\Users\Admin\AppData\Local\Temp\ClientH.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2932
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC wasted9sss1-57562.portmap.host 57562 uSzDNutNI.exe2⤵PID:2652
-
C:\Windows\regedit.exe"regedit.exe" "C:\Users\Admin\Desktop\DenyRestart.reg"1⤵
- Runs .reg file with regedit
PID:2028
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\TraceMount.aiff"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3016
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-71-0x0000000003BD0000-0x0000000003BD1000-memory.dmpFilesize
4KB
-
memory/1080-74-0x0000000003BD0000-0x0000000003BD1000-memory.dmpFilesize
4KB
-
memory/1924-54-0x00000000008C0000-0x00000000008DC000-memory.dmpFilesize
112KB
-
memory/1924-55-0x0000000073E80000-0x000000007456E000-memory.dmpFilesize
6.9MB
-
memory/1924-69-0x0000000073E80000-0x000000007456E000-memory.dmpFilesize
6.9MB
-
memory/2028-75-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/2652-56-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2652-57-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2652-59-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2652-58-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2652-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2652-62-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2652-64-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2652-66-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2652-68-0x0000000073E80000-0x000000007456E000-memory.dmpFilesize
6.9MB
-
memory/2652-70-0x0000000004770000-0x00000000047B0000-memory.dmpFilesize
256KB
-
memory/2652-72-0x0000000073E80000-0x000000007456E000-memory.dmpFilesize
6.9MB
-
memory/2652-73-0x0000000004770000-0x00000000047B0000-memory.dmpFilesize
256KB
-
memory/3016-86-0x000000013FEE0000-0x000000013FFD8000-memory.dmpFilesize
992KB
-
memory/3016-87-0x000007FEF7130000-0x000007FEF7164000-memory.dmpFilesize
208KB
-
memory/3016-88-0x000007FEF5880000-0x000007FEF5B34000-memory.dmpFilesize
2.7MB
-
memory/3016-89-0x000007FEFB000000-0x000007FEFB018000-memory.dmpFilesize
96KB
-
memory/3016-90-0x000007FEF7310000-0x000007FEF7327000-memory.dmpFilesize
92KB
-
memory/3016-91-0x000007FEF6590000-0x000007FEF65A1000-memory.dmpFilesize
68KB
-
memory/3016-92-0x000007FEF6150000-0x000007FEF6167000-memory.dmpFilesize
92KB
-
memory/3016-93-0x000007FEF5F10000-0x000007FEF5F21000-memory.dmpFilesize
68KB
-
memory/3016-94-0x000007FEF5EF0000-0x000007FEF5F0D000-memory.dmpFilesize
116KB
-
memory/3016-95-0x000007FEF5ED0000-0x000007FEF5EE1000-memory.dmpFilesize
68KB
-
memory/3016-96-0x000007FEF5400000-0x000007FEF5600000-memory.dmpFilesize
2.0MB
-
memory/3016-97-0x000007FEF4350000-0x000007FEF53FB000-memory.dmpFilesize
16.7MB
-
memory/3016-98-0x000007FEF4310000-0x000007FEF434F000-memory.dmpFilesize
252KB
-
memory/3016-99-0x000007FEF42E0000-0x000007FEF4301000-memory.dmpFilesize
132KB
-
memory/3016-100-0x000007FEF5EB0000-0x000007FEF5EC8000-memory.dmpFilesize
96KB
-
memory/3016-101-0x000007FEF5860000-0x000007FEF5871000-memory.dmpFilesize
68KB
-
memory/3016-102-0x000007FEF42C0000-0x000007FEF42D1000-memory.dmpFilesize
68KB
-
memory/3016-103-0x000007FEF42A0000-0x000007FEF42B1000-memory.dmpFilesize
68KB
-
memory/3016-104-0x000007FEF4280000-0x000007FEF429B000-memory.dmpFilesize
108KB
-
memory/3016-105-0x000007FEF4260000-0x000007FEF4271000-memory.dmpFilesize
68KB
-
memory/3016-106-0x000007FEF4240000-0x000007FEF4258000-memory.dmpFilesize
96KB
-
memory/3016-107-0x000007FEF4210000-0x000007FEF4240000-memory.dmpFilesize
192KB
-
memory/3016-108-0x000007FEF41A0000-0x000007FEF4207000-memory.dmpFilesize
412KB
-
memory/3016-109-0x000007FEF4130000-0x000007FEF419F000-memory.dmpFilesize
444KB
-
memory/3016-110-0x000007FEF4110000-0x000007FEF4121000-memory.dmpFilesize
68KB
-
memory/3016-111-0x000007FEF40B0000-0x000007FEF4106000-memory.dmpFilesize
344KB
-
memory/3016-112-0x000007FEF4080000-0x000007FEF40A8000-memory.dmpFilesize
160KB
-
memory/3016-113-0x000007FEF4050000-0x000007FEF4074000-memory.dmpFilesize
144KB
-
memory/3016-114-0x000007FEF4030000-0x000007FEF4047000-memory.dmpFilesize
92KB
-
memory/3016-115-0x000007FEF4000000-0x000007FEF4023000-memory.dmpFilesize
140KB
-
memory/3016-116-0x000007FEF3FE0000-0x000007FEF3FF1000-memory.dmpFilesize
68KB
-
memory/3016-117-0x000007FEF3FC0000-0x000007FEF3FD2000-memory.dmpFilesize
72KB
-
memory/3016-118-0x000007FEF3F90000-0x000007FEF3FB1000-memory.dmpFilesize
132KB
-
memory/3016-119-0x000007FEF3F70000-0x000007FEF3F83000-memory.dmpFilesize
76KB
-
memory/3016-120-0x000007FEF3F50000-0x000007FEF3F62000-memory.dmpFilesize
72KB
-
memory/3016-121-0x000007FEF3E10000-0x000007FEF3F4B000-memory.dmpFilesize
1.2MB
-
memory/3016-122-0x000007FEF3DE0000-0x000007FEF3E0C000-memory.dmpFilesize
176KB
-
memory/3016-123-0x000007FEF3C20000-0x000007FEF3DD2000-memory.dmpFilesize
1.7MB
-
memory/3016-124-0x000007FEF3BC0000-0x000007FEF3C1C000-memory.dmpFilesize
368KB
-
memory/3016-125-0x000007FEF3BA0000-0x000007FEF3BB1000-memory.dmpFilesize
68KB
-
memory/3016-126-0x000007FEF3B00000-0x000007FEF3B97000-memory.dmpFilesize
604KB
-
memory/3016-127-0x000007FEF3AE0000-0x000007FEF3AF2000-memory.dmpFilesize
72KB
-
memory/3016-128-0x000007FEF38A0000-0x000007FEF3AD1000-memory.dmpFilesize
2.2MB
-
memory/3016-129-0x000007FEF3780000-0x000007FEF3892000-memory.dmpFilesize
1.1MB
-
memory/3016-130-0x000007FEF3740000-0x000007FEF3775000-memory.dmpFilesize
212KB
-
memory/3016-131-0x000007FEF3710000-0x000007FEF3735000-memory.dmpFilesize
148KB
-
memory/3016-132-0x000007FEF36F0000-0x000007FEF3701000-memory.dmpFilesize
68KB
-
memory/3016-133-0x000007FEF3680000-0x000007FEF36E1000-memory.dmpFilesize
388KB
-
memory/3016-134-0x000007FEF3660000-0x000007FEF3671000-memory.dmpFilesize
68KB
-
memory/3016-135-0x000007FEF3640000-0x000007FEF3652000-memory.dmpFilesize
72KB
-
memory/3016-136-0x000007FEF3620000-0x000007FEF3633000-memory.dmpFilesize
76KB
-
memory/3016-137-0x000007FEF3580000-0x000007FEF361F000-memory.dmpFilesize
636KB
-
memory/3016-138-0x000007FEF3560000-0x000007FEF3571000-memory.dmpFilesize
68KB