Analysis
-
max time kernel
62s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
13-08-2023 19:52
Behavioral task
behavioral1
Sample
Client.exe
Resource
win7-20230712-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
Client.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
Client.exe
-
Size
158KB
-
MD5
c7c699eb8695a564fe0b400b1bf138ba
-
SHA1
52e3be4428c5c2b42d64ba9bcc584472391157c5
-
SHA256
0351128bc2273d12ca8042b029f9081c9205e2adad3a12f70a5696d23a6a036e
-
SHA512
94c24a31cbf13d96fa0922769faa7210f0994dba80886591401b722808009301dee2ae9a0ff0386381f26e93f9e88713c0c3a3d73b4e3908b04094dfa6d97ba4
-
SSDEEP
3072:TbzWH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPfOO8Y:TbzWe0ODhTEPgnjuIJzo+PPcfPfB8
Score
10/10
Malware Config
Extracted
Family
arrowrat
Botnet
Client
C2
147.185.221.16:24073
Mutex
GoeUqgRRx
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 2596 Client.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 980 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2596 Client.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeShutdownPrivilege 1536 explorer.exe Token: SeDebugPrivilege 980 taskmgr.exe Token: SeShutdownPrivilege 1536 explorer.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 1536 explorer.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe 980 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2596 Client.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 2596 wrote to memory of 1536 2596 Client.exe 28 PID 2596 wrote to memory of 1536 2596 Client.exe 28 PID 2596 wrote to memory of 1536 2596 Client.exe 28 PID 1536 wrote to memory of 1520 1536 explorer.exe 30 PID 1536 wrote to memory of 1520 1536 explorer.exe 30 PID 1536 wrote to memory of 1520 1536 explorer.exe 30 PID 2596 wrote to memory of 2888 2596 Client.exe 29 PID 2596 wrote to memory of 2888 2596 Client.exe 29 PID 2596 wrote to memory of 2888 2596 Client.exe 29 PID 2596 wrote to memory of 2888 2596 Client.exe 29 PID 2596 wrote to memory of 2548 2596 Client.exe 31 PID 2596 wrote to memory of 2548 2596 Client.exe 31 PID 2596 wrote to memory of 2548 2596 Client.exe 31 PID 2596 wrote to memory of 2548 2596 Client.exe 31 PID 2596 wrote to memory of 624 2596 Client.exe 32 PID 2596 wrote to memory of 624 2596 Client.exe 32 PID 2596 wrote to memory of 624 2596 Client.exe 32 PID 2596 wrote to memory of 624 2596 Client.exe 32 PID 2596 wrote to memory of 2852 2596 Client.exe 33 PID 2596 wrote to memory of 2852 2596 Client.exe 33 PID 2596 wrote to memory of 2852 2596 Client.exe 33 PID 2596 wrote to memory of 2852 2596 Client.exe 33 PID 2596 wrote to memory of 2904 2596 Client.exe 34 PID 2596 wrote to memory of 2904 2596 Client.exe 34 PID 2596 wrote to memory of 2904 2596 Client.exe 34 PID 2596 wrote to memory of 2904 2596 Client.exe 34 PID 2596 wrote to memory of 2920 2596 Client.exe 36 PID 2596 wrote to memory of 2920 2596 Client.exe 36 PID 2596 wrote to memory of 2920 2596 Client.exe 36 PID 2596 wrote to memory of 2920 2596 Client.exe 36 PID 2596 wrote to memory of 2952 2596 Client.exe 35 PID 2596 wrote to memory of 2952 2596 Client.exe 35 PID 2596 wrote to memory of 2952 2596 Client.exe 35 PID 2596 wrote to memory of 2952 2596 Client.exe 35 PID 2596 wrote to memory of 3020 2596 Client.exe 37 PID 2596 wrote to memory of 3020 2596 Client.exe 37 PID 2596 wrote to memory of 3020 2596 Client.exe 37 PID 2596 wrote to memory of 3020 2596 Client.exe 37 PID 2596 wrote to memory of 2908 2596 Client.exe 39 PID 2596 wrote to memory of 2908 2596 Client.exe 39 PID 2596 wrote to memory of 2908 2596 Client.exe 39 PID 2596 wrote to memory of 2908 2596 Client.exe 39 PID 2596 wrote to memory of 2864 2596 Client.exe 38 PID 2596 wrote to memory of 2864 2596 Client.exe 38 PID 2596 wrote to memory of 2864 2596 Client.exe 38 PID 2596 wrote to memory of 2864 2596 Client.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:1520
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2888
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2548
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:624
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2852
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2904
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2952
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2920
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:3020
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2864
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 147.185.221.16 24073 GoeUqgRRx2⤵PID:2908
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:980