Overview

overview

10

Static

static

10

ClientH.exe

windows7-x64

10

ClientH.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    1800s
  • max time network
    1806s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-07-2023 10:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ClientH.exe

  • Size

    90KB

  • MD5

    5ac5cf4a09a5c6dfd82669a0e24f675d

  • SHA1

    4f0993bfd2245da594000bb7c2d2bd7d02b60d53

  • SHA256

    6136b0b9b28b52962f090cdf34ac650c4b184f3a65e863e2051cdc1219aff051

  • SHA512

    e0317cf9a5a495f5e90a88f4a96517626a30c016b7374db41bc79a8bcb0920fcf7691ca3cf48c712b8bc2db075d734ca7cacc771e8f604297600187afe314d3f

  • SSDEEP

    1536:dbRiQMB57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33a:dbRO57SKsstcnZTJQDgWPaySsdH5K

Score
10/10
arrowratvenomhvncpersistencerat

Malware Config

Extracted

Family

arrowrat

Botnet

VenomHVNC

C2

wasted9sss1-57562.portmap.host:57562

Mutex

uSzDNutNI.exe

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
    persistence
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ClientH.exe
    "C:\Users\Admin\AppData\Local\Temp\ClientH.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4368
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC wasted9sss1-57562.portmap.host 57562 uSzDNutNI.exe
      2⤵
        PID:1080
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:5084
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4936
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 4936 -s 3956
        2⤵
        • Program crash
        PID:4272
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 432 -p 4936 -ip 4936
      1⤵
        PID:3556
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3784
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 3784 -s 3964
          2⤵
          • Program crash
          PID:1740
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -pss -s 540 -p 3784 -ip 3784
        1⤵
          PID:312
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of SetWindowsHookEx
          PID:1348
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 1348 -s 3592
            2⤵
            • Program crash
            PID:1936
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -pss -s 548 -p 1348 -ip 1348
          1⤵
            PID:4660
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
            • Modifies Internet Explorer settings
            • Modifies registry class
            • Suspicious use of SetWindowsHookEx
            PID:4604
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 4604 -s 3556
              2⤵
              • Program crash
              PID:4716
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -pss -s 548 -p 4604 -ip 4604
            1⤵
              PID:4636
            • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
              "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
              1⤵
              • Modifies Internet Explorer settings
              • Modifies registry class
              • Suspicious use of SetWindowsHookEx
              PID:3796
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 3796 -s 3564
                2⤵
                • Program crash
                PID:3028
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -pss -s 448 -p 3796 -ip 3796
              1⤵
                PID:5016
              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                1⤵
                • Modifies registry class
                PID:456

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                Filesize

                97B

                MD5

                75fdba27ae111f9312c9b243a5e22d02

                SHA1

                0bbbf13546b05600dbeb285609adcff5e12c2e24

                SHA256

                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                SHA512

                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_AutoGenerated_{0A6AC72E-ED8C-C16F-38B6-05831557CF24}
                Filesize

                36KB

                MD5

                8aaad0f4eb7d3c65f81c6e6b496ba889

                SHA1

                231237a501b9433c292991e4ec200b25c1589050

                SHA256

                813c66ce7dec4cff9c55fb6f809eab909421e37f69ff30e4acaa502365a32bd1

                SHA512

                1a83ce732dc47853bf6e8f4249054f41b0dea8505cda73433b37dfa16114f27bfed3b4b3ba580aa9d53c3dcc8d48bf571a45f7c0468e6a0f2a227a7e59e17d62

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\{1AC14E77-02E7-4E5D-B744-2EB1AE5198B7}_charmap_exe
                Filesize

                36KB

                MD5

                406347732c383e23c3b1af590a47bccd

                SHA1

                fae764f62a396f2503dd81eefd3c7f06a5fb8e5f

                SHA256

                e0a9f5c75706dc79a44d0c890c841b2b0b25af4ee60d0a16a7356b067210038e

                SHA512

                18905eaad8184bb3a7b0fe21ff37ed2ee72a3bd24bb90cbfcad222cf09e2fa74e886d5c687b21d81cd3aec1e6c05891c24f67a8f82bafd2aceb0e0dcb7672ce7

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                Filesize

                97B

                MD5

                75fdba27ae111f9312c9b243a5e22d02

                SHA1

                0bbbf13546b05600dbeb285609adcff5e12c2e24

                SHA256

                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                SHA512

                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                Filesize

                97B

                MD5

                75fdba27ae111f9312c9b243a5e22d02

                SHA1

                0bbbf13546b05600dbeb285609adcff5e12c2e24

                SHA256

                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                SHA512

                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                Filesize

                97B

                MD5

                75fdba27ae111f9312c9b243a5e22d02

                SHA1

                0bbbf13546b05600dbeb285609adcff5e12c2e24

                SHA256

                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                SHA512

                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                Download Submit

              • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\7ZZHJ0NR\microsoft.windows[1].xml
                Filesize

                97B

                MD5

                75fdba27ae111f9312c9b243a5e22d02

                SHA1

                0bbbf13546b05600dbeb285609adcff5e12c2e24

                SHA256

                62198536b21cc7cad5b396303999bb4ad75ad784e120525be4b8b8a503f05d89

                SHA512

                855ad3a011f011fc715020029dfce87fd1812bd6d94b5aafdc731b591fe24c681048009427d22da931fc13a1b7cdbca5e8336a79f03d6e226d9984118f2a306c

                Download Submit

              • memory/1080-143-0x0000000005750000-0x0000000005760000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1080-165-0x0000000075040000-0x00000000757F0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/1080-137-0x0000000000400000-0x0000000000410000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1080-141-0x0000000075040000-0x00000000757F0000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/1080-142-0x0000000005830000-0x00000000058C2000-memory.dmp

                Filesize

                584KB

                Download

              • memory/1080-166-0x0000000005750000-0x0000000005760000-memory.dmp

                Filesize

                64KB

                Download

              • memory/1348-192-0x000002C2A8C20000-0x000002C2A8C40000-memory.dmp

                Filesize

                128KB

                Download

              • memory/1348-196-0x000002C2A89E0000-0x000002C2A8A00000-memory.dmp

                Filesize

                128KB

                Download

              • memory/1348-198-0x000002CAAA000000-0x000002CAAA020000-memory.dmp

                Filesize

                128KB

                Download

              • memory/2184-140-0x0000000074FA0000-0x0000000075750000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/2184-135-0x0000000004FD0000-0x0000000005574000-memory.dmp

                Filesize

                5.6MB

                Download

              • memory/2184-134-0x0000000074FA0000-0x0000000075750000-memory.dmp

                Filesize

                7.7MB

                Download

              • memory/2184-133-0x00000000000A0000-0x00000000000BC000-memory.dmp

                Filesize

                112KB

                Download

              • memory/2184-136-0x0000000004BC0000-0x0000000004C5C000-memory.dmp

                Filesize

                624KB

                Download

              • memory/3784-176-0x00000201A4390000-0x00000201A43B0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3784-181-0x00000201A47A0000-0x00000201A47C0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3784-174-0x00000201A43D0000-0x00000201A43F0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3796-240-0x000002CD6EB90000-0x000002CD6EBB0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3796-236-0x000002CD6E740000-0x000002CD6E760000-memory.dmp

                Filesize

                128KB

                Download

              • memory/3796-234-0x000002CD6E780000-0x000002CD6E7A0000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4368-144-0x0000000002840000-0x0000000002841000-memory.dmp

                Filesize

                4KB

                Download

              • memory/4604-218-0x0000016408E20000-0x0000016408E40000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4604-216-0x0000016408A20000-0x0000016408A40000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4604-213-0x0000016408A60000-0x0000016408A80000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4936-156-0x0000025185B70000-0x0000025185B90000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4936-151-0x0000025185720000-0x0000025185740000-memory.dmp

                Filesize

                128KB

                Download

              • memory/4936-154-0x00000251853D0000-0x00000251853F0000-memory.dmp

                Filesize

                128KB

                Download