f87afdb24721791be0b5b0a400b20a4f6545f8738b6a6665e1b0d09213c43b5f

General

Target

r01-25Arrival.exe
Size

618KB
MD5

bec209eaa0b01e498c6c9ad2125dbf14
SHA1

09913142c461e6f00db09fbe439d35a8d415a224
SHA256

f87afdb24721791be0b5b0a400b20a4f6545f8738b6a6665e1b0d09213c43b5f
SHA512

2456da62da5cd70121442398d722eef872256fa444ee9e7dc1c0f1a089392b7e5928c32a65bc988b3a2515a25b5455000c41275f47e147b5d3a4ec5ae89d3115
SSDEEP

12288:vU3Yks4nIsHm/wBzG1kmEbgIgcj4ZayL6/Qc1/IuR6:vJ8nIsGIBzr8Igcj40ykquR

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2404 set thread context of 2892	2404	r01-25Arrival.exe	29
PID 2892 set thread context of 1384	2892	r01-25Arrival.exe	18
PID 2892 set thread context of 2464	2892	r01-25Arrival.exe	32
PID 2464 set thread context of 1384	2464	netiougc.exe	18

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
2404	r01-25Arrival.exe
2892	r01-25Arrival.exe
2892	r01-25Arrival.exe
2892	r01-25Arrival.exe
2892	r01-25Arrival.exe
2892	r01-25Arrival.exe
2892	r01-25Arrival.exe
2892	r01-25Arrival.exe
2892	r01-25Arrival.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe
2464	netiougc.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
2892	r01-25Arrival.exe
1384	Explorer.EXE
1384	Explorer.EXE
2464	netiougc.exe
2464	netiougc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	r01-25Arrival.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 2904	2404	r01-25Arrival.exe	28
PID 2404 wrote to memory of 2904	2404	r01-25Arrival.exe	28
PID 2404 wrote to memory of 2904	2404	r01-25Arrival.exe	28
PID 2404 wrote to memory of 2904	2404	r01-25Arrival.exe	28
PID 2404 wrote to memory of 2892	2404	r01-25Arrival.exe	29
PID 2404 wrote to memory of 2892	2404	r01-25Arrival.exe	29
PID 2404 wrote to memory of 2892	2404	r01-25Arrival.exe	29
PID 2404 wrote to memory of 2892	2404	r01-25Arrival.exe	29
PID 2404 wrote to memory of 2892	2404	r01-25Arrival.exe	29
PID 2404 wrote to memory of 2892	2404	r01-25Arrival.exe	29
PID 2404 wrote to memory of 2892	2404	r01-25Arrival.exe	29
PID 1384 wrote to memory of 2464	1384	Explorer.EXE	32
PID 1384 wrote to memory of 2464	1384	Explorer.EXE	32
PID 1384 wrote to memory of 2464	1384	Explorer.EXE	32
PID 1384 wrote to memory of 2464	1384	Explorer.EXE	32

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Users\Admin\AppData\Local\Temp\r01-25Arrival.exe
  "C:\Users\Admin\AppData\Local\Temp\r01-25Arrival.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Users\Admin\AppData\Local\Temp\r01-25Arrival.exe
    "C:\Users\Admin\AppData\Local\Temp\r01-25Arrival.exe"
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\r01-25Arrival.exe
    "C:\Users\Admin\AppData\Local\Temp\r01-25Arrival.exe"
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:2892
- C:\Windows\SysWOW64\netiougc.exe
  "C:\Windows\SysWOW64\netiougc.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:2464

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1384-18-0x0000000002E90000-0x0000000002F90000-memory.dmp

Filesize
1024KB

Download
memory/1384-19-0x0000000008980000-0x000000000A4D6000-memory.dmp

Filesize
27.3MB

Download
memory/1384-27-0x0000000008980000-0x000000000A4D6000-memory.dmp

Filesize
27.3MB

Download
memory/2404-12-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2404-0-0x00000000011E0000-0x0000000001280000-memory.dmp

Filesize
640KB

Download
memory/2404-2-0x0000000004DD0000-0x0000000004E10000-memory.dmp

Filesize
256KB

Download
memory/2404-3-0x00000000004E0000-0x00000000004F8000-memory.dmp

Filesize
96KB

Download
memory/2404-4-0x0000000000610000-0x0000000000618000-memory.dmp

Filesize
32KB

Download
memory/2404-5-0x0000000000620000-0x000000000062C000-memory.dmp

Filesize
48KB

Download
memory/2404-6-0x00000000053D0000-0x000000000544E000-memory.dmp

Filesize
504KB

Download
memory/2404-1-0x0000000074AC0000-0x00000000751AE000-memory.dmp

Filesize
6.9MB

Download
memory/2464-28-0x0000000000080000-0x00000000000BA000-memory.dmp

Filesize
232KB

Download
memory/2464-25-0x0000000000080000-0x00000000000BA000-memory.dmp

Filesize
232KB

Download
memory/2464-24-0x0000000000C70000-0x0000000000F73000-memory.dmp

Filesize
3.0MB

Download
memory/2464-26-0x0000000000460000-0x00000000004FC000-memory.dmp

Filesize
624KB

Download
memory/2464-29-0x0000000000460000-0x00000000004FC000-memory.dmp

Filesize
624KB

Download
memory/2464-21-0x0000000000080000-0x00000000000BA000-memory.dmp

Filesize
232KB

Download
memory/2464-20-0x0000000000080000-0x00000000000BA000-memory.dmp

Filesize
232KB

Download
memory/2892-15-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2892-16-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2892-17-0x0000000000210000-0x000000000022D000-memory.dmp

Filesize
116KB

Download
memory/2892-22-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2892-23-0x0000000000210000-0x000000000022D000-memory.dmp

Filesize
116KB

Download
memory/2892-14-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2892-13-0x0000000000810000-0x0000000000B13000-memory.dmp

Filesize
3.0MB

Download
memory/2892-11-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2892-8-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download
memory/2892-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2892-7-0x0000000000400000-0x000000000043D000-memory.dmp

Filesize
244KB

Download

Analysis

Sharing