Overview

overview

10

Static

static

10

bSU4.exe

windows7-x64

10

bSU4.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-01-2024 05:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bSU4.exe

  • Size

    138KB

  • MD5

    4b1ce3fe71b14c655755251616d61766

  • SHA1

    9941994468ad58962f5063ae0d1998790b577744

  • SHA256

    63ab8bad7e72c1c4044743b0de2efd791a4f9bf12e85b2bd973b7309d50eafc8

  • SHA512

    dd87f5d2bb7a4a903981de9156e6249c514b138747300ceb84bf0e230c38010a34f51df17717b73c5e9dece2524c61ffcbe4015ec0b59e85c477aeb92d9530ae

  • SSDEEP

    3072:qbvF5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YM:qbvzS7BqjjYHdrqkL/

Score
10/10
arrowratsub70fpersistencerat

Malware Config

Extracted

Family

arrowrat

Botnet

SUB70F

C2

instruments-george.gl.at.ply.gg:12129

Mutex

58PJXL

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 10 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 49 IoCs
  • Suspicious use of SendNotifyMessage 21 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bSU4.exe
    "C:\Users\Admin\AppData\Local\Temp\bSU4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" SUB70F instruments-george.gl.at.ply.gg 12129 58PJXL
      2⤵
        PID:2732
      • C:\Windows\explorer.exe
        "C:\Windows\explorer.exe"
        2⤵
        • Modifies Installed Components in the registry
        • Enumerates connected drives
        • Checks SCSI registry key(s)
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:392
    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:3328
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4152
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:4268
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1796
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2440
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:1088
    • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
      "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
      1⤵
      • Modifies registry class
      PID:2948

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Office_SETLANG_EXE_15
      Filesize

      36KB

      MD5

      0e2a09c8b94747fa78ec836b5711c0c0

      SHA1

      92495421ad887f27f53784c470884802797025ad

      SHA256

      0c1cdbbf6d974764aad46477863059eaec7b1717a7d26b025f0f8fe24338bb36

      SHA512

      61530a33a6109467962ba51371821ea55bb36cd2abc0e7a15f270abf62340e9166e66a1b10f4de9a306b368820802c4adb9653b9a5acd6f1e825e60128fd2409

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\AppIconCache\100\Microsoft_Windows_Explorer
      Filesize

      36KB

      MD5

      ab0262f72142aab53d5402e6d0cb5d24

      SHA1

      eaf95bb31ae1d4c0010f50e789bdc8b8e3116116

      SHA256

      20a108577209b2499cfdba77645477dd0d9771a77d42a53c6315156761efcfbb

      SHA512

      bf9580f3e5d1102cf758503e18a2cf98c799c4a252eedf9344f7c5626da3a1cf141353f01601a3b549234cc3f2978ad31f928068395b56f9f0885c07dbe81da1

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133496825000299028.txt
      Filesize

      74KB

      MD5

      c09e63e4b960a163934b3c29f3bd2cc9

      SHA1

      d3a43b35c14ae2e353a1a15c518ab2595f6a0399

      SHA256

      308deca5e1ef4d875fbe0aff3ce4b0b575b28e643dffda819d4390ec77faf157

      SHA512

      5ca3321034dff47e3afe0b0bdfaffc08782991660910a29375a8e0363794b78247282aba65dbd882ae225aa140ae63927dfd0946a441ee6fa64a1d8c146777b9

      Download Submit

    • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\UA6WZR2N\microsoft.windows[1].xml
      Filesize

      96B

      MD5

      b97f6e2cc1520a2e8426851cb68f3b0f

      SHA1

      33a930fe90facb202ec3cd87ca0275af9dd20155

      SHA256

      a3546f0c8e475abc90346821be3c3d67f522161ea876c3d14247ba6d79a2b5aa

      SHA512

      9b3771942ffce17a52d4c0598bd0d4bb8f196c8731e5b129524b3d9507d411895e4c43d84479f06e5fb28c3403d6b0ec63b97f3a3cdb598873d17fd637abd06a

      Download Submit

    • memory/392-17-0x0000000002960000-0x0000000002961000-memory.dmp

      Filesize

      4KB

      Download

    • memory/1088-118-0x000002739F440000-0x000002739F460000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1088-116-0x0000026B9DE20000-0x0000026B9DE40000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1088-114-0x0000026B9DE60000-0x0000026B9DE80000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1796-64-0x000001CCA5A20000-0x000001CCA5A40000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1796-66-0x000001CCA5E30000-0x000001CCA5E50000-memory.dmp

      Filesize

      128KB

      Download

    • memory/1796-62-0x000001CCA5A60000-0x000001CCA5A80000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2440-97-0x00000204464E0000-0x0000020446500000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2440-99-0x00000204468F0000-0x0000020446910000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2440-95-0x0000020446520000-0x0000020446540000-memory.dmp

      Filesize

      128KB

      Download

    • memory/2732-9-0x0000000005AA0000-0x0000000006044000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/2732-8-0x00000000053E0000-0x00000000053F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2732-1-0x0000000000400000-0x0000000000416000-memory.dmp

      Filesize

      88KB

      Download

    • memory/2732-129-0x00000000053E0000-0x00000000053F0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/2732-128-0x0000000074D60000-0x0000000075510000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2732-5-0x0000000074D60000-0x0000000075510000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/2732-6-0x0000000005160000-0x00000000051F2000-memory.dmp

      Filesize

      584KB

      Download

    • memory/2732-13-0x0000000006250000-0x00000000062A0000-memory.dmp

      Filesize

      320KB

      Download

    • memory/2732-10-0x00000000059A0000-0x0000000005A06000-memory.dmp

      Filesize

      408KB

      Download

    • memory/2732-7-0x0000000005200000-0x000000000529C000-memory.dmp

      Filesize

      624KB

      Download

    • memory/4104-0-0x000001FE9CE30000-0x000001FE9CE58000-memory.dmp

      Filesize

      160KB

      Download

    • memory/4104-4-0x00007FF8C3030000-0x00007FF8C3AF1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4104-2-0x00007FF8C3030000-0x00007FF8C3AF1000-memory.dmp

      Filesize

      10.8MB

      Download

    • memory/4152-25-0x000002BA86460000-0x000002BA86480000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4152-23-0x000002BA864A0000-0x000002BA864C0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4152-27-0x000002BA86870000-0x000002BA86890000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4268-44-0x000001F374B90000-0x000001F374BB0000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4268-46-0x000001F374B50000-0x000001F374B70000-memory.dmp

      Filesize

      128KB

      Download

    • memory/4268-48-0x000001F374F60000-0x000001F374F80000-memory.dmp

      Filesize

      128KB

      Download