Overview

overview

10

Static

static

10

Client.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-05-2024 14:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Client.exe

  • Size

    158KB

  • MD5

    0dd200d5163a677c9f2c4eaa73210ed6

  • SHA1

    a828ef3fd25efc9896fd6488a0d07a4bf91804d7

  • SHA256

    e9d64e1290c710d5d24535336eb50aadcd001cbcee1a95693849cc3d1f8f6bc1

  • SHA512

    f247fc1f557be801e6661e08201a40bbd4292666627a3cbe29df75545728ce975aa2fc2a90a2452690cebf2be0cfe98eabef5cab05c423617ccb26c8b20803a0

  • SSDEEP

    3072:gbzbDH+0OoCthfbEFtbcfjF45gjryKKqH6JY2doszEmQotEPPcfPSSO8Y:gbzbDe0ODhTEPgnjuIJzo+PPcfPSN8

Score
10/10
arrowratclientpersistencerat

Malware Config

Extracted

Family

arrowrat

Botnet

Client

C2

192.168.56.1:2600

Mutex

IGmexvmSD

Signatures

  • ArrowRat

    Remote access tool with various capabilities first seen in late 2021.

    ratarrowrat
  • Modifies Installed Components in the registry 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 22 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 2 IoCs
    adwarespyware
  • Modifies registry class 33 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 31 IoCs
  • Suspicious use of FindShellTrayWindow 50 IoCs
  • Suspicious use of SendNotifyMessage 22 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Client.exe
    "C:\Users\Admin\AppData\Local\Temp\Client.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1392
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      2⤵
      • Modifies Installed Components in the registry
      • Enumerates connected drives
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:4332
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 192.168.56.1 2600 IGmexvmSD
      2⤵
        PID:4452
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 192.168.56.1 2600 IGmexvmSD
        2⤵
          PID:2212
      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1216
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:3212

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133601722167560715.txt
        Filesize

        75KB

        MD5

        ce88a108043a3d69e5325754ba9c7181

        SHA1

        c64f06b8081f5ec0ae7c0e1fe7b0f248aa6550c4

        SHA256

        b2552766ebb3469549cea5b6b609077fa6e38c000eba6befadfd275e11a8095e

        SHA512

        cb5e53fb1520b68178ad465cde801ed779521b843de44f894fc8fdbd071f33f663a60f570b134ff0996bf407ef9ecee72810b16dd9276469e6b0efb5d5c85829

        Download Submit

      • memory/1392-0-0x00007FFDB2F23000-0x00007FFDB2F25000-memory.dmp

        Filesize

        8KB

        Download

      • memory/1392-1-0x000001680F6D0000-0x000001680F6FE000-memory.dmp

        Filesize

        184KB

        Download

      • memory/1392-195-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1392-3-0x00007FFDB2F20000-0x00007FFDB39E1000-memory.dmp

        Filesize

        10.8MB

        Download

      • memory/1392-194-0x00007FFDB2F23000-0x00007FFDB2F25000-memory.dmp

        Filesize

        8KB

        Download

      • memory/2212-10-0x0000000006790000-0x00000000067E0000-memory.dmp

        Filesize

        320KB

        Download

      • memory/2212-7-0x0000000005EE0000-0x0000000005F46000-memory.dmp

        Filesize

        408KB

        Download

      • memory/2212-6-0x0000000005FE0000-0x0000000006584000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/2212-5-0x00000000057B0000-0x000000000584C000-memory.dmp

        Filesize

        624KB

        Download

      • memory/2212-4-0x0000000005710000-0x00000000057A2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/2212-2-0x0000000000400000-0x0000000000418000-memory.dmp

        Filesize

        96KB

        Download

      • memory/3212-15-0x000001B410E00000-0x000001B410F00000-memory.dmp

        Filesize

        1024KB

        Download

      • memory/3212-20-0x000001BC13140000-0x000001BC13160000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3212-51-0x000001BC13510000-0x000001BC13530000-memory.dmp

        Filesize

        128KB

        Download

      • memory/3212-50-0x000001BC13100000-0x000001BC13120000-memory.dmp

        Filesize

        128KB

        Download

      • memory/4332-14-0x0000000002CA0000-0x0000000002CA1000-memory.dmp

        Filesize

        4KB

        Download